Summary:
The "Essential Addons for Elementor" plugin, which is widely used on WordPress, has been discovered to have a vulnerability that allows remote attackers to gain administrator privileges on the site without authentication. Over a million WordPress websites utilize "Elementor," a page builder, and among the library of 90 extensions available for it, "Essential Addons for Elementor" is a popular option. A security vulnerability has been identified in versions 5.4.0 through 5.7.1 of the "Essential Addons for Elementor" plugin. The flaw, tracked as CVE-2023-32243, pertains to the plugin's password reset functionality and allows unauthenticated users to escalate privileges. The vulnerability was discovered on May 8, 2023.[/subscribe_to_unlock_form]
Summary:
The "Essential Addons for Elementor" plugin, which is widely used on WordPress, has been discovered to have a vulnerability that allows remote attackers to gain administrator privileges on the site without authentication. Over a million WordPress websites utilize "Elementor," a page builder, and among the library of 90 extensions available for it, "Essential Addons for Elementor" is a popular option. A security vulnerability has been identified in versions 5.4.0 through 5.7.1 of the "Essential Addons for Elementor" plugin. The flaw, tracked as CVE-2023-32243, pertains to the plugin's password reset functionality and allows unauthenticated users to escalate privileges. The vulnerability was discovered on May 8, 2023.[emaillocker id="1283"]
The vulnerability can be exploited to reset the password of any user, requiring only knowledge of their username. This allows an attacker to reset the password of an administrator and gain access to their account. The vulnerability exists due to a lack of validation of the password reset key in the password reset function. As a result, the function directly modifies the password of the targeted user. The impact of this vulnerability can be severe, leading to unauthorized access to sensitive information, website defacement or deletion, distribution of malware to site visitors, and damage to the website owner's reputation and legal compliance.
To avoid raising suspicion with the website administrator, the attacker must provide random values in the POST inputs for both 'page_id' and 'widget_id' when exploiting the vulnerability. The attacker must provide the appropriate nonce value in the 'eael-resetpassword-nonce' input to authenticate the password reset request. The new password must then be specified in the 'eael-pass1' and 'eael-pass2' parameters. The essential-addons-elementor nonce value can be obtained from the main front-end page of the WordPress site, as it is set in the $this->localize_objects variable by the load_common_asset function. If the 'rp_login' parameter contains a valid username, the code will update the targeted user's password to the one provided by the attacker, granting them access to the account.
According to the security firm, resolving the vulnerability was a simple matter of the plugin vendor implementing a function to validate the presence and authenticity of the password reset key in reset requests. The latest version of the Essential Addons for Elementor plugin, version 5.7.2, includes the fix for this vulnerability and was released recently. It is highly recommended that all users of the plugin upgrade to this version as soon as possible.
Recommendations:
We strongly recommend that you update your Essential Addons for Elementor plugin to version 5.7.2 or later.
References:
The following reports contain further technical details:
[/emaillocker]