PT-2021-15895 · WordPress · The Plus Addons For Elementor Page Builder

Nicolas Vidal · Published 2021-06-14 · Updated 2022-10-25 · CVE-2021-24359

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Plus Addons for Elementor Page Builder WordPress plugin versions prior to 4.1.11

Description The issue allows an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site, as the plugin did not properly check that a user requesting a password reset was the legitimate user. This could potentially lead to an account takeover when chained with another issue.

Recommendations For versions prior to 4.1.11, update to version 4.1.11 or later to resolve the issue. As a temporary workaround, consider restricting password reset functionality until the update is applied.

Exploit

Fix

Improper Authentication

Improper Access Control

Weakness Enumeration

CWE-287

CWE-284

Related Identifiers

CVE-2021-24359

Affected Products

The Plus Addons For Elementor Page Builder

References · 4

• 🔥 https://wpscan.com/vulnerability/486b82d1-30d4-44d2-9542-f33e3f149e92 · Exploit
• https://theplusaddons.com/changelog · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-24359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24359 · Security Note