PT-2020-16469 · Elementor · Elementor Pro

Published 2020-10-07 · Updated 2021-07-21 · CVE-2020-26596

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Elementor Pro plugin versions through 3.0.5

Description The issue allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet.

Recommendations For Elementor Pro plugin versions through 3.0.5, consider removing the Dynamic OOO widget or restrict availability of the Editor role to mitigate the issue.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-26596

Affected Products

Elementor Pro

References · 4

• 🔥 https://ww2.compunet.cl/dia-cero-en-plugin-de-wordpres-detectada-compunet-redteam · Exploit
• https://elementor.com/pro/changelog · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26596 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26596 · Security Note