A Vulnerability in WordPress Elementor Pro Plugin Could Allow for Remote Code Execution

ITS Advisory Number: 
2020-063
Date(s) Issued: 
Friday, May 8, 2020
Subject: 
A Vulnerability in WordPress Elementor Pro Plugin Could Allow for Remote Code Execution
Overview: 

A vulnerability has been discovered in the Elementor Pro Plugin that could allow for remote code execution. WordPress is a web-based publishing application implemented in PHP, and the Elementor Pro Plugin allows website designers and creators to create webpages using custom themes and widgets. Successful exploitation of this vulnerability could allow for remote code execution.

 

THREAT INTELLIGENCE:

On May 6th, Wordfence announced active exploitation of this vulnerability was observed in the wild.

Systems Affected: 
  • Elementor Pro prior to 2.9.4
RISK
GOVERNMENT
Large and medium government entities: 
Medium
Small government entities: 
Medium
BUSINESS
Large and medium business entities: 
Medium
Small business entities: 
Medium
Home Users: 
Low
Description: 

A vulnerability has been discovered in the Elementor Pro Plugin that could allow for remote code execution. This vulnerability can be exploited if user registration is enabled on the affected site. If enabled, registered users can upload arbitrary files which can lead to remote code execution.

 

Wordfence notes there is a workaround to bypass the registration requirement to exploit the vulnerability. If Ultimate Addons for Elementor is also used on the same Wordpress site, threat actors can exploit a separate vulnerability affecting Ultimate Addons to register as a subscriber-level user. Subscriber-level users would then be able exploit the vulnerability in Elementor Pro, that could allow for remote code execution.

Actions: 
  • After appropriate testing, immediately apply the updates provided by Elementor manually to affected systems.
  • Apply the Principle of Least Privilege to all systems and services.
  • Verify no unauthorized system modifications have occurred on system before applying patch.
  • Monitor intrusion detection systems for any signs of anomalous activity.
  • Unless required, limit external network access to affected products.