PT-2024-11044 · WordPress · Essential Addons For Elementor

Chloe Chamberland · Published 2024-10-15 · Updated 2025-01-10 · CVE-2021-4447

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Essential Addons for Elementor plugin for WordPress versions up to and including 4.6.4

Description The issue is related to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create a new registration form that defaults to the user role being set to administrator and subsequently register as an administrative user.

Recommendations For versions up to and including 4.6.4, update the plugin to the latest version to protect the site. As a temporary workaround, consider restricting access to the Elementor page builder to minimize the risk of exploitation. Avoid using the registration form feature in the affected plugin until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-4447

Affected Products

Essential Addons For Elementor

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-4447 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4447 · Vendor Advisory
• https://twitter.com/CVEnew/status/1846444806584590689 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/be098ee9-b749-4908-85e8-e717d019609a?source=cve · Note
• https://twitter.com/transilienceai/status/1847688680745353707 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2526471%40essential-addons-for-elementor-lite&new=2526471%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail= · Note
• https://twitter.com/transilienceai/status/1847688684797133038 · Twitter Post
• https://t.me/cvenotify/107043 · Telegram Post
• https://twitter.com/cracbot/status/1848242891980001404 · Twitter Post
• https://twitter.com/CveFindCom/status/1846446680175956387 · Twitter Post