Critical WordPress plugin bug leaves millions of sites open to attack

WordPress logo
(Image credit: WordPress)

A new, dangerous vulnerability in a popular WordPress (opens in new tab) plugin was recently discovered. Cybersecurity researchers from Wordfence uncovered a flaw in the Elementor (opens in new tab) plugin that allowed any authenticated user to upload arbitrary PHP code.

Elementor is one of the most popular plugins for WordPress (opens in new tab), installed on more than five million websites. 

The plugin was recently upgraded to version 3.6.0, which introduced, among other things, a new Onboarding module, whose goal was to simplify the plugin’s initial setup. However, the researchers discovered the module using an “unusual” method to register AJAX actions, with no capability checks.

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022 (opens in new tab)

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022 (opens in new tab). Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey (opens in new tab) to get the bookazine, worth $10.99/£10.99.

Executing malicious code

“There are a number of ways for an authenticated user to obtain the Ajax::NONCE_KEY, but one of the simplest ways is to view the source of the admin dashboard as a logged-in user, as it is present for all authenticated users, even for subscriber-level users,” the researchers explain.

Consequently, any logged-in user could use any of the onboarding functions. That being said, an attacker could, for example, create a malicious “Elementor Pro” plugin zip, and use the onboarding functions to install it. The site would then execute any code present in the plugin, including code designed to take over the site, or access additional resources on the server. 

The functions could also be used to completely deface the site, it was added.

The good news is that the flaw is not present in any Elementor versions prior to 3.6.0, and the patch for the bug is already available. 

On April 12, the team published the 3.6.3. version of the plugin, with Wordfence urging all Elementor users to upgrade their plugins as soon as possible. 

Being one of the most popular plugins for WordPress, Elementor is often a target for bug hunters and threat actors.

In early February, cybersecurity researcher Wai Yan Muo Thet discovered a vulnerability in the Essential Addons for Elementor plugin - a critical remote code execution (RCE) flaw that allowed potential malicious actors to perform a local file inclusion attack.

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.