Critical Bug Found In WordPress Plugin For Elementor With Over A Million Installations

 

A WordPress plugin with over one million installs has been found to contain a critical vulnerability that could result in the execution of arbitrary code on compromised websites.

The plugin in question is Essential Addons for Elementor, which provides WordPress site owners with a library of over 80 elements and extensions to help design and customize pages and posts.

"This vulnerability allows any user, regardless of their authentication or authorization status, to perform a local file inclusion attack," Patchstack said in a report. "This attack can be used to include local files on the filesystem of the website, such as /etc/passwd. This can also be used to perform RCE by including a file with malicious PHP code that normally cannot be executed."

That said, the vulnerability only exists if widgets like dynamic gallery and product gallery are used, which utilize the vulnerable function, resulting in local file inclusion – an attack technique in which a web application is tricked into exposing or running arbitrary files on the webserver.

The flaw impacts all versions of the addon from 5.0.4 and below, and credited with discovering the vulnerability is researcher Wai Yan Myo Thet. Following responsible disclosure, the security hole was finally plugged in version 5.0.5 released on January 28 "after several insufficient patches."

The development comes weeks after it emerged that unidentified actors tampered with dozens of WordPress themes and plugins hosted on a developer's website to inject a backdoor with the goal of infecting further sites.

Related articles

1. Hacker Security Tools
2. Hacker Tools For Windows
3. Hacking Tools Usb
4. Hacker Tools For Mac
5. Tools For Hacker
6. Hacker Tools Hardware
7. Hack Tools For Mac
8. Hacking Tools Mac
9. Easy Hack Tools
10. Pentest Tools Alternative
11. Ethical Hacker Tools
12. Hacking Tools Online
13. Hacker Tools Windows
14. Pentest Reporting Tools
15. Hacker Techniques Tools And Incident Handling
16. Hacker Tool Kit
17. Hack Rom Tools
18. How To Hack
19. Github Hacking Tools
20. Pentest Tools Framework
21. Hacking Tools Github
22. Hacking Tools Free Download
23. Pentest Tools Windows
24. Hacker Security Tools
25. Physical Pentest Tools
26. Physical Pentest Tools
27. Hak5 Tools
28. Hack And Tools
29. Pentest Tools Android
30. Free Pentest Tools For Windows
31. Hacking Tools Name
32. Hacking Tools For Windows 7
33. Pentest Tools Tcp Port Scanner
34. Pentest Tools Website
35. Pentest Tools For Android
36. Hack App
37. Pentest Tools Review
38. Pentest Box Tools Download
39. Ethical Hacker Tools
40. Hacker Security Tools
41. Hacking Tools Software
42. Hacker Tools List
43. Hacker Techniques Tools And Incident Handling
44. Hacking Tools For Windows
45. Hacker Tools
46. Computer Hacker
47. Hacking App
48. Hack Apps
49. Hacker Security Tools
50. Hacking Tools Free Download
51. Hacking Tools For Windows 7
52. Hacker Security Tools
53. Pentest Tools Online
54. Hacker Tools Free
55. Hack Tools For Mac