PT-2024-21431 · WordPress · Unlimited Elements For Elementor

Wesley · Published 2024-05-10 · Updated 2025-01-30 · CVE-2024-2662

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.102

Description The issue is due to insufficient filtering of template attributes during the creation of HTML for custom widgets. This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary commands on the server.

Recommendations For versions up to, and including, 1.5.102, update to a version that fixes the command injection issue. As a temporary workaround, consider restricting access to custom widget creation to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-2662

Affected Products

Unlimited Elements For Elementor

References · 7

• https://plugins.trac.wordpress.org/changeset/3071404/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_template_engine.class.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-2662 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2662 · Vendor Advisory
• https://twitter.com/cracbot/status/1791710400058409182 · Twitter Post
• https://t.me/cvenotify/109198 · Telegram Post
• https://twitter.com/cracbot/status/1792072785495466185 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/58492dbb-b9e0-4477-b85d-ace06dba954c?source=cve · Note