CVE-2023-48760 is a high severity (CVSS 8.2) missing authorization flaw in JetElements For Elementor by Crocoblock, affecting versions through 2.6.13. The record shows high integrity impact and no login needed. Update the plugin past 2.6.13 and confirm the fixed version with the Patchstack entry.
What's affected
- JetElements For Elementor by Crocoblock, from the first release through 2.6.13, per the NVD record.
- The Patchstack entry the record links is titled as an unauthenticated broken access control issue. We could not open it, so confirm specifics there.
- It sits next to CVE-2023-48759 in the same plugin and version range, which has a confidentiality focus.
- Fixed version: not confirmed from a source we fetched. Look for a release later than 2.6.13.
- Severity: the record gives CVSS 8.2, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is none, on integrity high and on availability low. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
JetElements For Elementor is a WordPress plugin, so the quickest check is the version on the Plugins screen or from WP-CLI on the server.
wp plugin list --fields=name,status,version | grep -i jet-elements
wp plugin get jet-elements --field=version
Anything at or below 2.6.13 is inside the range in the record. If you manage many sites, run the same command across each one, and check staging and forgotten test sites as well as production. A site with the plugin installed but deactivated is a smaller risk than an active one, yet it is still worth updating or deleting.
What to do now
- Update JetElements For Elementor to the newest available release and verify it is above 2.6.13.
- Review recent changes to pages and content built with Elementor for edits nobody on your team made.
- Check the access log for unusual requests to WordPress AJAX endpoints around plugin related actions.
- Rotate any administrator passwords if you find evidence of unexpected changes.
- Subscribe to the plugin vendor's release notes so future fixes are not missed.
Why it matters
This is another CWE-862 (Missing Authorization) case. The plugin let a request through without a permission check. With no privileges needed and a high integrity impact, the vector describes an outsider who can change something on the site. The low availability impact in the vector suggests some disruption is possible too.
The record is thin on mechanics, and we are not going to fill in the blanks. What we can say is that this class of flaw is common in plugins because every action handler has to check permission itself, and one missing check is enough. Keeping the plugin count low and updating promptly is the practical control.
Quick check
How is this different from CVE-2023-48759?
Same plugin and versions, but this one scores high on integrity impact where the other scores high on confidentiality.
What if I cannot update immediately?
Deactivate the plugin until you can. Without a confirmed workaround from the vendor, removal is the safest stopgap.
Sources
Last reviewed: 19 October 2026.
