Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation
Strategic Overview
<= 5.7.1CVE-2023-32243Vulnerability Overview
The Essential Addons for Elementor plugin for WordPress is vulnerable to Unauthenticated Arbitrary Password Resets to Privilege Escalation in versions up to, and including, 5.7.1. This is due to a lack of validation of a password reset key in the reset_password function. This makes it possible for unauthenticated attackers to reset the password of any user on a vulnerable site, including an administrator, if they have the email or username of the targeted account.
Technical Analysis
REMEDIATION: Update to version 5.7.2, or a newer patched version --- IDENTIFIER: CWE-620 (Unverified Password Change) When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C