CVE-2023-48759 is a high severity (CVSS 7.5) missing authorization flaw in JetElements For Elementor by Crocoblock, affecting versions through 2.6.13. The record rates confidentiality impact as high. Update the plugin beyond 2.6.13 and verify the fixed release in the Patchstack entry.
What's affected
- JetElements For Elementor by Crocoblock, from the first release through 2.6.13, per the NVD record.
- The Patchstack entry linked in the record is titled as an unauthenticated arbitrary attachment download issue. We could not open the page, so confirm the details there.
- The sibling flaw CVE-2023-48760 affects the same plugin and the same version range, with a different effect.
- Fixed version: not confirmed from a fetched source. Look for a release after 2.6.13.
- Severity: the record gives CVSS 7.5, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity none and on availability none. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
JetElements For Elementor is a WordPress plugin, so the quickest check is the version on the Plugins screen or from WP-CLI on the server.
wp plugin list --fields=name,status,version | grep -i jet-elements
wp plugin get jet-elements --field=version
Anything at or below 2.6.13 is inside the range in the record. If you manage many sites, run the same command across each one, and check staging and forgotten test sites as well as production. A site with the plugin installed but deactivated is a smaller risk than an active one, yet it is still worth updating or deleting.
The directory slug in the Patchstack link is jet-elements.
What to do now
- Update JetElements For Elementor to the newest release and verify the version is above 2.6.13.
- Update the sibling fix for CVE-2023-48760 at the same time, since it is in the same version range.
- Check the media library for files that were never meant to be reachable, such as private documents or invoices.
- Remove the plugin if you no longer use its widgets.
- Consider a web application firewall rule set that covers WordPress plugin endpoints while you patch.
Why it matters
The class is CWE-862 (Missing Authorization). The plugin offered an action without checking that the caller was allowed to perform it. The vector has no privileges and no user interaction, and the only impact is confidentiality, so the reasonable reading is that data can be read without logging in. The Patchstack title points to attachments, meaning files in the WordPress media library.
Media libraries often hold more than marketing images. PDFs, price lists and uploaded customer files end up there. When you inventory plugins, ask what data each one can reach, and not just what it renders.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an account?
The record's vector says no privileges are required, and the Patchstack title says unauthenticated.
Is this the same as CVE-2023-48760?
No. It is the same plugin and range but a separate flaw, with a different impact profile in the record.
Sources
Last reviewed: 19 October 2026.
