CVE-2022-1329CWE-434CWE-862

Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

High · published April 19, 2022

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 99.8th percentile for exploit probability.

CVSS v3.1

8.8

EPSS

93%

Percentile

99.8

In the wild

Unconfirmed

What it is

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.92658 · 99.8th percentile
Weaknesses: CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-862 · Missing Authorization
Published: 2022-04-19T00:00Z

EPSS history

Timeline

19 APR 00:00Z
Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution
cvelistv5