PT-2024-31215 · WordPress · The 140+ Widgets

Francesco Carlucci · Published 2024-05-23 · Updated 2024-05-24 · CVE-2024-4471

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The 140+ Widgets | Best Addons For Elementor – FREE for WordPress versions up to, and including, 1.4.3.1

Description The issue allows authenticated attackers with contributor-level permissions and above to inject a PHP Object via deserialization of untrusted input in the export content function. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations For versions up to, and including, 1.4.3.1, consider disabling the export content function until a patch is available to prevent the deserialization of untrusted input. Restrict access to the vulnerable plugin to minimize the risk of exploitation. Avoid using the plugin with contributor-level permissions and above until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-4471

Affected Products

The 140+ Widgets

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-4471 · Security Note
• https://plugins.trac.wordpress.org/changeset/3090127 · Note
• https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/libs/demo-export/classes/class-demo-export-admin.php#L86 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5c517278-9d2a-4ef6-bf0e-a62f6b00dd20?source=cve · Note
• https://t.me/cvenotify/80863 · Telegram Post