PT-2024-36387 · WordPress · The Plus Addons For Elementor Page Builder

Wesley · Published 2024-06-20 · Updated 2024-07-17 · CVE-2024-5455

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Plus Addons for Elementor Page Builder plugin for WordPress versions up to, and including, 5.5.4

Description: The issue allows authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server via the magazine style parameter within the Dynamic Smart Showcase widget. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Recommendations: Update to version 5.5.5 to resolve the issue. As a temporary workaround, consider restricting access to the Dynamic Smart Showcase widget until a patch is available. Avoid using the magazine style parameter in the affected widget until the issue is resolved.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2024-5455

Affected Products

The Plus Addons For Elementor Page Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-5455 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5455 · Vendor Advisory
• https://roadmap.theplusaddons.com/updates · Note
• https://twitter.com/CveFindCom/status/1803994123168362525 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8699142d-4ddd-4ca1-9886-9b2d905a36cd?source=cve · Note
• https://t.me/cvenotify/86501 · Telegram Post
• https://t.me/cvenotify/83967 · Telegram Post
• https://twitter.com/CVEnew/status/1803994448000393287 · Twitter Post