PT-2020-13343 · Elementor · Elementor Pro

Published 2020-05-17 · Updated 2021-05-21 · CVE-2020-13126

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elementor Pro plugin versions prior to 2.9.4

Description An issue in the Elementor Pro plugin allows an attacker with the Subscriber role to upload arbitrary executable files, resulting in remote code execution. This issue has been exploited in the wild.

Recommendations For Elementor Pro plugin versions prior to 2.9.4, update to version 2.9.4 or later to resolve the issue. As a temporary workaround, consider restricting file upload capabilities for users with the Subscriber role until the update is applied.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-13126

Affected Products

Elementor Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-13126 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13126 · Vendor Advisory
• https://t.me/cvenotify/3862 · Telegram Post
• https://t.me/cvenotify/14802 · Telegram Post
• https://wpvulndb.com/vulnerabilities/10214 · Note
• https://wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk · Note
• https://t.me/cvenotify/3863 · Telegram Post