Critical Bug Found In WordPress Plugin For Elementor With Over A Million Installations

 

A WordPress plugin with over one million installs has been found to contain a critical vulnerability that could result in the execution of arbitrary code on compromised websites.

The plugin in question is Essential Addons for Elementor, which provides WordPress site owners with a library of over 80 elements and extensions to help design and customize pages and posts.

"This vulnerability allows any user, regardless of their authentication or authorization status, to perform a local file inclusion attack," Patchstack said in a report. "This attack can be used to include local files on the filesystem of the website, such as /etc/passwd. This can also be used to perform RCE by including a file with malicious PHP code that normally cannot be executed."

That said, the vulnerability only exists if widgets like dynamic gallery and product gallery are used, which utilize the vulnerable function, resulting in local file inclusion – an attack technique in which a web application is tricked into exposing or running arbitrary files on the webserver.

The flaw impacts all versions of the addon from 5.0.4 and below, and credited with discovering the vulnerability is researcher Wai Yan Myo Thet. Following responsible disclosure, the security hole was finally plugged in version 5.0.5 released on January 28 "after several insufficient patches."

The development comes weeks after it emerged that unidentified actors tampered with dozens of WordPress themes and plugins hosted on a developer's website to inject a backdoor with the goal of infecting further sites.

More information

1. Hacker Hardware Tools
2. Tools For Hacker
3. Kik Hack Tools
4. Hack Tools
5. Nsa Hack Tools Download
6. Top Pentest Tools
7. Hacking Tools Name
8. Install Pentest Tools Ubuntu
9. Tools 4 Hack
10. Hacking Tools For Beginners
11. What Is Hacking Tools
12. Pentest Tools Alternative
13. Hacking Tools For Beginners
14. Hack Tools Download
15. Hackrf Tools
16. Pentest Tools For Ubuntu
17. Pentest Tools Android
18. Hackrf Tools
19. Pentest Reporting Tools
20. Hack Tools Online
21. Hacking Tools Windows 10
22. How To Make Hacking Tools
23. Best Hacking Tools 2020
24. Usb Pentest Tools
25. Hacker Tools For Pc
26. How To Make Hacking Tools
27. Hacker Tools 2020
28. Pentest Tools Tcp Port Scanner
29. Pentest Tools Github
30. Pentest Box Tools Download
31. Pentest Tools
32. Hack Tools Online
33. Hack Tools Github
34. Hacking Tools For Kali Linux
35. Hacking Tools For Games
36. Hack Tools For Ubuntu
37. Tools 4 Hack
38. Pentest Tools Github
39. Pentest Tools Website Vulnerability
40. Pentest Tools Free
41. Hacker Tools Apk
42. Hacking Tools For Mac
43. Nsa Hack Tools
44. Hack Tools Pc
45. Hack Tool Apk No Root
46. Hacking App
47. Usb Pentest Tools
48. Hacker Security Tools
49. Pentest Tools Alternative
50. Hacker Tools Windows
51. Pentest Tools Alternative
52. Hacking Tools And Software
53. Hacking Tools Free Download
54. Hack Tools For Windows
55. Hack Tools For Pc
56. Hack Tools Online
57. Pentest Tools Website
58. Hack Rom Tools
59. Hack Tools For Ubuntu
60. Hacking Tools Usb
61. Pentest Tools For Windows
62. Hacking Tools Software
63. Black Hat Hacker Tools
64. Pentest Tools Alternative
65. Pentest Tools Alternative
66. Pentest Tools Alternative
67. Hacking Tools Free Download
68. Android Hack Tools Github
69. Hacking Tools Name
70. Hacking Tools Windows 10
71. Game Hacking
72. Best Pentesting Tools 2018
73. Pentest Tools Framework
74. Hacking Tools 2020