PT-2020-13342 · Elementor · Ultimate Addons For Elementor

Published 2020-05-17 · Updated 2025-12-30 · CVE-2020-13125

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Elementor plugin versions prior to 1.24.2

Description An issue in the Ultimate Addons for Elementor plugin allows unauthenticated attackers to create users with the Subscriber role, even when registration is disabled. This issue has been exploited in the wild.

Recommendations For Ultimate Addons for Elementor plugin versions prior to 1.24.2, update to version 1.24.2 or later to resolve the issue.

Fix

Related Identifiers

CVE-2020-13125

Affected Products

Ultimate Addons For Elementor

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-13125 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13125 · Vendor Advisory
• https://t.me/cvenotify/14802 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2005866469142511978 · Twitter Post
• https://t.me/cvenotify/3863 · Telegram Post
• https://t.me/cvenotify/3862 · Telegram Post
• https://wpvulndb.com/vulnerabilities/10214 · Note
• https://wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk · Note