Medium severity · published Aug 21, 2020
CVE-2020-20634
Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature
6.5
CVSS
1%
EPSS
No
On KEV
Description
Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WB
Website Builder · Elementor
through 2.9.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-20634
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-20634
Exploit
https://blog.nintechnet.com/wordpress-elementor-plugin-fixed-safe-mode-privilege-escalation-vulnerability/
More from Website Builder
9.8
CVE-2023-47504
WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability
9.8
CVE-2020-7109
The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template
8.8
CVE-2023-48777
WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability
8.8
CVE-2022-1329
Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution
8.1
CVE-2024-24934
WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability