Critical Bug Found in WordPress Plugin for Elementor with Over a Million Installations

A WordPress plugin with over one million installs has been found
to contain a critical vulnerability that could result in the
execution of arbitrary code on compromised websites.

The plugin in question is Essential Addons for Elementor^[1], which provides
WordPress site owners with a library of over 80 elements and
extensions to help design and customize pages and posts.

“This vulnerability allows any user, regardless of their
authentication or authorization status, to perform a local file
inclusion attack,” Patchstack said^[2]
in a report. “This attack can be used to include local files on the
filesystem of the website, such as /etc/passwd. This can also be
used to perform RCE by including a file with malicious PHP code
that normally cannot be executed.”

That said, the vulnerability only exists if widgets like dynamic
gallery and product gallery are used, which utilize the vulnerable
function, resulting in local file inclusion – an attack technique
in which a web application is tricked into exposing or running
arbitrary files on the webserver.

The flaw impacts all versions of the addon from 5.0.4 and below,
and credited with discovering the vulnerability is researcher Wai
Yan Myo Thet. Following responsible disclosure, the security hole
was finally plugged in version 5.0.5 released on January 28 “after
several insufficient patches.”

The development comes weeks after it emerged that unidentified
actors tampered with dozens of WordPress themes and
plugins^[3] hosted on a developer’s
website to inject a backdoor with the goal of infecting further
sites.