Elementor has patched a critical Remote Code Execution vulnerability that was discovered by threat analyst Ramuel Gall from Wordfence on March 29, 2022. Wordfence disclosed the vulnerability to Elementor via its official security contact email address but did not receive a timely reply. On April 11, 2022, Wordfence disclosed the vulnerability to the WordPress Plugins team. Elementor released a patch in version 3.6.3 on April 12, 2022.
Wordfence described the vulnerability as “Insufficient Access Control leading to Subscriber+ Remote Code Execution.” It received a CVSS (Common Vulnerability Scoring System) score of 9.9 (Critical). The vulnerability affects Elementor’s new onboarding module, introduced recently in version 3.6.0.
Wordfence published a technical explanation of how an attacker might gain unauthorized access:
The module uses an unusual method to register AJAX actions, adding an
admin_initlistener in its constructor that first checks whether or not a request was to the AJAX endpoint and contains a valid nonce before calling themaybe_handle_ajaxfunction.Unfortunately no capability checks were used in the vulnerable versions. There are a number of ways for an authenticated user to obtain the
Ajax::NONCE_KEY, but one of the simplest ways is to view the source of the admin dashboard as a logged-in user, as it is present for all authenticated users, even for subscriber-level users.
Elementor is installed on more than five million WordPress sites, but this particular vulnerability affects versions 3.6.0 – 3.6.2. At most, this would affect ~34% of users, according to the stats for the plugin’s current active versions. Now that the vulnerability is public, Elementor users are advised to update immediately to version 3.6.3 or later. A related security fix is packaged with version 3.6.4, according to the plugin’s changelog: “Fix: Optimized controls sanitization to enforce better security policies in Onboarding wizard.”
“Fix: Optimized controls sanitization to enforce better security policies in Onboarding wizard.”
Plugin authors can, and should, do better than this. When their sites at are risk, there is a responsibility to communicate clearly with owners of sites who have installed our plugins.
“Security fix: Versions 3.6.0 up to 3.6.3 contain a critical security vulnerability allowing any logged-in user (of any level) to take over complete control of the site. All sites with non-trusted users should update immediately.”