PT-2025-1665 · WordPress · Borderless – Widgets

Anhchangmutrang + 3 · Published 2025-01-30 · Updated 2025-01-31 · CVE-2024-11600

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress versions up to, and including, 1.5.9

Description The issue is related to Remote Code Execution due to a lack of sanitization on an imported JSON file. This allows authenticated attackers with Administrator-level access and above to execute code on the server via the write config function.

Recommendations For versions up to, and including, 1.5.9, update to a version that includes a fix for this issue, as the current version allows for Remote Code Execution due to the lack of sanitization in the write config function. As a temporary workaround, consider disabling the write config function until a patch is available.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-11600

Affected Products

Borderless – Widgets

References · 9

• https://osv.dev/vulnerability/CVE-2024-11600 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/borderless/tags/1.5.7/includes/icon-manager/icon-manager.php#L388 · Patch
• https://plugins.trac.wordpress.org/browser/borderless/tags/1.5.7/includes/icon-manager/icon-manager.php#L333 · Patch
• https://plugins.trac.wordpress.org/browser/borderless/tags/1.5.7/includes/icon-manager/icon-manager.php#L249 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-11600 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/643b8b82-c4e1-4b81-a7e0-aee0f9270702?source=cve · Note
• https://t.me/cvenotify/109533 · Telegram Post
• https://twitter.com/CVEnew/status/1884962392070574531 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3231327/borderless/trunk?contextall=1&old=3230461&old_path=%2Fborderless%2Ftrunk · Note