The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword' attribute of the "Login | Register Form" widget (disabled by default). This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
Configurations
Configuration 1 (hide)
|
History
08 Jan 2025, 19:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-502 | |
| CPE | cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:lite:wordpress:*:* | |
| First Time |
Wpdeveloper
Wpdeveloper essential Addons For Elementor |
|
| References | () https://plugins.trac.wordpress.org/changeset/3060417/essential-addons-for-elementor-lite - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/342049e5-834e-4867-8174-01ca7bb0caa2?source=cve - Third Party Advisory |
21 Nov 2024, 09:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset/3060417/essential-addons-for-elementor-lite - | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/342049e5-834e-4867-8174-01ca7bb0caa2?source=cve - |
30 Mar 2024, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-30 12:15
Updated : 2025-01-08 19:35
NVD link : CVE-2024-3018
Mitre link : CVE-2024-3018
CVE.ORG link : CVE-2024-3018
JSON object : View
Products Affected
wpdeveloper
- essential_addons_for_elementor
CWE
CWE-502
Deserialization of Untrusted Data