Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.6 - Authenticated (Contributor+) Missing Authorization to Template Data Request and CartFlows, Cart Abandonment Recovery and LatePoint Data Import
- ID
- WPSEC-2026-0181
- Plugin
- Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg (astra-sites)
- Affected
- all versions before 4.7.7
- Remediation
- Update to 4.7.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg on WPSec AttackSurface
- Fix released
- Published
Description
The Starter Templates plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an insufficient capability check on the template data request (astra-sites-api-request) and the CartFlows, Cart Abandonment Recovery and LatePoint import AJAX actions in all versions up to, and including, 4.7.6. These handlers checked only the edit_posts capability, and the nonce they require is exposed to Contributor-level users in the Elementor editor. This makes it possible for authenticated attackers, with contributor-level access and above, on sites where Elementor and the respective plugin are active, to choose which starter template's data is staged for import and then import that template's CartFlows flows (as published), Cart Abandonment Recovery email templates or LatePoint data. The LatePoint import drops and recreates the LatePoint database tables, replacing the site's existing bookings, customers and settings with the template's demo data.
References
- https://wpsec.com/vuln/WPSEC-2026-0181/
- https://plugins.svn.wordpress.org/astra-sites/tags/4.7.7/
- https://wordpress.org/plugins/astra-sites/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS