CVE-2020-26596

Elementor Pro <= 3.0.5 - Authenticated Remote Code Execution in Dynamic OOO Widget

2020-10-06 00:00
Anonymous

Strategic Overview

Status
Patched in 3.0.6
Affected Plugin
Elementor Website Builder Pro
Affected Version
<= 3.0.5
CVSS
7.2High
Weakness type
CWE-269 · Improper Privilege Management
CVE
CVE-2020-26596
View all Elementor Website Builder Pro vulnerabilities

At a glance

CVE-2020-26596 is a high-severity Improper Privilege Management vulnerability in the Elementor Website Builder Pro WordPress plugin, affecting versions <= 3.0.5. It carries a CVSS score of 7.2 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires an authenticated account. The issue is fixed in version 3.0.6; sites on affected versions should update now. Disclosed October 2020.

Vulnerability Overview

The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.

CWE-269: Improper Privilege Management

Reaching this weakness in Elementor Website Builder Pro <= 3.0.5 takes any authenticated account. Improper privilege management means the code lets an account end up with capabilities its role should not have.

It converts a low-privileged account into an administrative one, which makes every other restriction on the site irrelevant. For Elementor Website Builder Pro the fix is 3.0.6: builds <= 3.0.5 are affected, anything from 3.0.6 onward is not.

Remediation

Update to version 3.0.6, or a newer patched version

How does WordSec protect against this?

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Elementor Website Builder Pro 3.0.6 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2020-26596https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef3f7a2-4ed2-4235-8a6b-f2a5cf288029https://nvd.nist.gov/vuln/detail/CVE-2020-26596

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C