Published: 19/04/2022 Updated: 26/05/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 580

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for malicious users to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.

Vulnerable Product	Search on Vulmon	Subscribe to Product
elementor website builder

Check Point Reference: CPAI-2022-1928 Date Published: 20 Nov 2023 Severity: High ...

CVE-2022-1329-WordPress-Elementor-RCE This poc is based on the one of AkuCyberSec 中文版本 Usage Use docker-compose to start the vuln environment: docker-compose up -d Then you can access the WordPress Admin page with URL localhost:8000 Register the admin user, and add a no-admin user in the Users tag For example, there are t

WordPress Elementor 3.6.0 3.6.1 3.6.2 RCE POC

WP Elementor 360/1/2 Remote Code Execution Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec (githubcom/AkuCyberSec) Vendor Homepage: elementorcom/ Software Link: wordpressorg/plugins/elementor/advanced/ (scroll down to select the version) Version: 360, 361, 362 Tested on: WordPress 593 (os-independent since this exploit does

WordPress Plugin - Elementor 360 361 362 Remote Code Execution Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec (githubcom/AkuCyberSec) Vendor Homepage: elementorcom/ Software Link: wordpressorg/plugins/elementor/advanced/ (scroll down to select the version) Version: 360, 361, 362 Tested on: WordPress 593 (os-independent

CWE-434 CWE-862 https://plugins.trac.wordpress.org/changeset/2708766/elementor/trunk/core/app/modules/onboarding/module.php https://www.wordfence.com/blog/2022/04/elementor-critical-remote-code-execution-vulnerability/https://www.pluginvulnerabilities.com/2022/04/12/5-million-install-wordpress-plugin-elementor-contains-authenticated-remote-code-execution-rce-vulnerability/http://packetstormsecurity.com/files/168615/WordPress-Elementor-3.6.2-Shell-Upload.html https://nvd.nist.gov https://github.com/Grazee/CVE-2022-1329-WordPress-Elementor-RCE https://github.com/mcdulltii/CVE-2022-1329 https://advisories.checkpoint.com/defense/advisories/public/2023/cpai-2022-1928.html

CVE-2022-1329

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect