Critical Elementor Pro bug exposes WordPress sites to RCE attacks
-
Title: Critical Elementor Pro Vulnerability Allows Remote Code Execution on WordPress Sites
Summary: A high-severity flaw in the Elementor Pro plugin could let authenticated attackers upload malicious files, leading to full remote code execution. Patches are available; immediate updates are strongly advised.
Body:
A critical security flaw has been disclosed in the popular Elementor Pro WordPress plugin, which could give authenticated users the ability to upload arbitrary files, including PHP shells, leading to remote code execution (RCE) on the affected server.
The vulnerability, which has been assigned a high severity rating, stems from a broken access control issue combined with insecure file upload functionality. Successful exploitation could allow an attacker with low-level privileges to bypass existing restrictions and upload executable code. Once uploaded, the malicious file can be executed on the server, potentially allowing full site takeover, data theft, or lateral movement within the hosting environment.
While the technical advisory indicates that the affected component is the custom file upload handler, the core issue lies in missing authorization checks. This means that even subscribers or contributors on a target site might be able to trigger the flaw, depending on the plugin configuration.
The Elementor team has released a security patch in the latest version of the plugin. Site administrators are strongly urged to update Elementor Pro to the newest available version immediately. Those unable to update right away should consider restricting user registrations and reviewing all existing user roles for excessive permissions as temporary mitigation measures.
For additional details and the complete technical breakdown, please refer to the original report by BleepingComputer.
Source: BleepingComputer
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login