CVE-2021-24175

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.

Affected

The Plus Addons for Elementor Page Builder

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

14.46% chance of exploitation in the next 30 days, 97th percentile

Published

2021-04-05

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89

Exploit collections (1)

• WordPress Elementor Page Builder Plus插件身份验证绕过（CVE-2021-24175）.mdtzwlhack/Vulnerability

Security advisories

• https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-al…

References

• CVE Record
• NVD entry