Security readout for executives and security teams
Plain-English summary
CVE-2021-4445 affects the Premium Addons for Elementor WordPress plugin through version 4.5.1. A logged-in low-privilege user could change certain WordPress options to a value of 1 because an AJAX action lacked proper permission and nonce checks.
Executive priority
Treat as a moderate WordPress exposure. Prioritize sites with customer login, public registration, or many low-privilege users, because those conditions make the authentication requirement easier to satisfy.
Technical view
The pa_dismiss_admin_notice AJAX action missed capability and nonce validation, allowing authenticated Subscriber-level users or higher to perform limited arbitrary option updates. The value restriction to 1 limits impact, but option changes can still affect site behavior, confidentiality, integrity, or availability depending on the targeted option.
Likely exposure
Exposure is limited to WordPress sites running Premium Addons for Elementor version 4.5.1 or earlier with attacker access to any authenticated account at Subscriber level or above.
Exploitation context
The bundle does not identify active exploitation, and the CVE is not listed as KEV. Exploitation requires authentication and appears constrained to setting arbitrary options to 1, so urgency depends on whether public registration or untrusted subscriber accounts exist.
Researcher notes
Focus review on the vulnerable AJAX handler, missing authorization checks, and nonce enforcement. Assess business impact by identifying which option names could be set to 1 and whether any security-relevant settings could be altered in the local deployment.
Mitigation direction
- Update Premium Addons for Elementor beyond version 4.5.1 using vendor guidance.
- Review the WordPress.org plugin page and vendor advisories for current fixed-version guidance.
- Disable or restrict the plugin if updating is not immediately possible.
- Limit untrusted subscriber accounts and public registration until remediation is confirmed.
Validation and detection
- Inventory WordPress sites using Premium Addons for Elementor.
- Confirm installed plugin versions are newer than 4.5.1.
- Review whether public registration or untrusted Subscriber accounts are enabled.
- Check logs for unexpected authenticated AJAX requests to pa_dismiss_admin_notice.
- Review sensitive WordPress options for unexpected value changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-4445 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L2.33.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cffb26bc-3d3f-4593-bb36-d2abcd67861e?source=cveCVE reference
- https://ithemes.com/blog/wordpress-vulnerability-report-september-2021-part-2/#ib-toc-anchor-2CVE reference
- https://wpscan.com/vulnerability/2e5b3608-1dfc-468f-b3ae-12ce7c25ee6cCVE reference
- https://wordpress.org/plugins/premium-addons-for-elementor/CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2590819%40premium-addons-for-elementor&new=2590819%40premium-addons-for-elementor&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.