WordPress Elementor Pro Plugin Vulnerability Discovered

WordPress Elementor Pro Plugin Vulnerability Discovered

A cybersecurity advisory was issued Friday, May 8, 2020, regarding a vulnerability in WordPress Elementor Pro Plugin. The vulnerability could allow an attacker to execute remote code, which could potentially lead to a breach.

What It Is:
A vulnerability has been discovered in the Elementor Pro Plugin that could allow for remote code execution. WordPress is a web-based publishing application implemented in PHP, and the Elementor Pro Plugin allows website designers and creators to create webpages using custom themes and widgets.

Successful exploitation of this vulnerability could allow for remote code execution.

Read the original article from Wordfence.

Threat Intelligence:
On May 6, Wordfence announced active exploitation of this vulnerability was observed in the wild.

Systems Affected:
• Elementor Pro prior to 2.9.4

Risk:
Government:
• Large and medium government entities: High
• Small government entities: Medium
Businesses:
• Large and medium business entities: High
• Small business entities: Medium
Home users: Low

What It Means:
If you and/or your business utilize the Elementor Pro versions mentioned above, you will need to apply appropriate updates provided by Elementor manually to affected systems immediately following proper testing.

Technical Summary:
A vulnerability has been discovered in the Elementor Pro Plugin that could allow for remote code execution. This vulnerability can be exploited if user registration is enabled on the affected site. If enabled, registered users can upload arbitrary files which can lead to remote code execution.

Wordfence notes there is a workaround to bypass the registration requirement to exploit the vulnerability. If Ultimate Addons for Elementor is also used on the same WordPress site, threat actors can exploit a separate vulnerability affecting Ultimate Addons to register as a subscriber-level user. Subscriber-level users would then be able to exploit the vulnerability in Elementor Pro, which could allow for remote code execution.

What To Do:
We recommend the following actions be taken:

• Apply appropriate updates provided by Elementor manually to affected systems, immediately after appropriate testing.
• Apply the Principle of Least Privilege to all systems and services.
• Verify no unauthorized system modifications have occurred on the system before applying the patch.
• Monitor intrusion detection systems for any signs of anomalous activity.
• Unless required, limit external network access to affected products.

Negative Consequences of Lost or Stolen Data:
The loss or theft of proprietary data can have severe impacts, particularly if the compromise becomes public and sensitive information is exposed. Possible impacts include:

• Temporary or permanent loss of sensitive or proprietary information.
• Disruption to regular operations.
• Financial losses incurred to restore systems and files.
• Potential harm to an organization’s reputation.

Should your agency or business need assistance with issues arising from vulnerabilities in WordPress Elementor Pro Plugin including updates and/or patches, Dox can help. Please contact Dox if there is anything we can do to assist in securing your agency, business, or organization.

Thank you for your time and stay safe online.