The WordPress plugin Essentials Addon for Elementor, which has over a million installations, was recently found to have a critical security vulnerability. According to IT researchers, the flaw allows unregistered attackers on a network to completely compromise a WordPress instance. The vulnerability, named CVE-2023-32243 and assigned a CVSS rating of 9.8, is classified as “critical.”
Thankfully, an updated version of the plugin, version 5.7.2, has been released and is available for installation on the plugin website. The researchers urge Essential Addons for Elementor users to install the update as soon as possible to prevent attacks.
The vulnerability exists in plugin versions from 5.4.0 up to and including 5.7.1. An analysis of the plugin by Patchstack’s IT researchers found that the security vulnerability allows any unauthenticated user to escalate their rights to those of any user of the WordPress website. This means that any user’s password can be reset as long as their username is known. This allows attackers to reset the administrator’s password and log into their account.
The flaw occurs because the password reset function does not validate an associated key and instead directly changes the password of the user in question. The article further explains that the IT researchers provide a detailed analysis of the vulnerability along with code snippets.
The plugin’s developers responded quickly to the vulnerability. They closed the security gap within three days of the vulnerability being reported, releasing the updated plugin on Thursday. IT managers with a vulnerable WordPress installation should install the update immediately.
It’s worth noting that this isn’t the first time a WordPress plugin has faced high-risk vulnerabilities. In April, Elementor Pro experienced a critical vulnerability that attackers actively exploited, gaining administrative access to WordPress websites. Therefore, it’s essential to stay vigilant and regularly update all plugins to ensure optimal security.
