dexit / CVE-2022-1329

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to o CVE project by @Sn0wAlice

CVE-2022-1329

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.

authentication	complexity	vector
SINGLE	LOW	NETWORK

confidentiality	integrity	availability
PARTIAL	PARTIAL	PARTIAL

CVSS Score: 6.5

References

• https://plugins.trac.wordpress.org/changeset/2708766/elementor/trunk/core/app/modules/onboarding/module.php

• https://www.wordfence.com/blog/2022/04/elementor-critical-remote-code-execution-vulnerability/

• https://www.pluginvulnerabilities.com/2022/04/12/5-million-install-wordpress-plugin-elementor-contains-authenticated-remote-code-execution-rce-vulnerability/

• http://packetstormsecurity.com/files/168615/WordPress-Elementor-3.6.2-Shell-Upload.html

Brut File

• CVE-2022-1329.json

External Repositories

Name	Link
CVE-2022-1329	CVE-2022-1329
CVE-2022-1329-WordPress-Elementor-3.6.0-3.6.1-3.6.2-Remote-Code-Execution-Exploit	CVE-2022-1329-WordPress-Elementor-3.6.0-3.6.1-3.6.2-Remote-Code-Execution-Exploit
CVE-2022-1329-WordPress-Elementor-RCE	CVE-2022-1329-WordPress-Elementor-RCE

About this repository

This repository is part of the project Live Hack CVE. Made by Sn0wAlice for the people that care about security and need to have a feed of the latest CVEs. Hope you enjoy it, don't forget to star the repo and follow me on Twitter and Github