PT-2021-15721 · WordPress · The Plus Addons For Elementor Page Builder

Antony Booker + 1 · Published 2021-04-05 · Updated 2025-09-24 · CVE-2021-24175

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder WordPress plugin versions prior to 4.1.7

Description: The issue allows malicious actors to bypass authentication, enabling unauthenticated users to log in as any user, including admin, by providing the related username. Additionally, it allows the creation of accounts with arbitrary roles, such as admin. This can be exploited even if registration is disabled and the Login widget is not active.

Recommendations: For versions prior to 4.1.7, update to version 4.1.7 or later to resolve the issue. As a temporary workaround, consider disabling the Login widget and restricting user registration to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-24175

Affected Products

The Plus Addons For Elementor Page Builder

References · 6

• 🔥 https://wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24175 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24175 · Vendor Advisory
• https://wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover · Note
• https://posimyth.ticksy.com/ticket/2713734 · Note
• https://twitter.com/pdnuclei_bot/status/1970896035212939631 · Twitter Post