High severity · published Apr 19, 2022
CVE-2022-1329
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the…
8.8
CVSS
92.7%
EPSS
No
On KEV
Description
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)92.7% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WB
Website Builder · Elementor
3.6.0 through 3.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-1329
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-1329
Exploit
http://packetstormsecurity.com/files/168615/WordPress-Elementor-3.6.2-Shell-Upload.html
Patch
https://plugins.trac.wordpress.org/changeset/2708766/elementor/trunk/core/app/modules/onboarding/module.php
Exploit
https://www.pluginvulnerabilities.com/2022/04/12/5-million-install-wordpress-plugin-elementor-contains-authenticated-remote-code-execution-rce-vulnerability/
Exploit
https://www.wordfence.com/blog/2022/04/elementor-critical-remote-code-execution-vulnerability/
More from Website Builder
9.8
CVE-2023-47504
WordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability
9.8
CVE-2020-7109
The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template
8.8
CVE-2023-48777
WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability
8.1
CVE-2024-24934
WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability
7.2
CVE-2023-0329
Elementor Website Builder < 3.12.2 - Admin+ SQLi