Elementor Plugin Vulnerabilities Exploited to Hack WordPress Sites

08 May 2020

Elementor Plugin Vulnerabilities Exploited to Hack WordPress Sites

Threat actors are actively targeting a vulnerability in the Elementor Pro plugin for WordPress to compromise websites, WordPress security company Defiant warned this week.

With an estimated install base of over 1 million websites, Elementor Pro is the paid version of the free Elementor plugin (which has more than 4 million users), a drag and drop page builder. Only Elementor Pro, which is available as a separate download, is impacted by the vulnerability.

Assessed with a CVSS score of 9.9, the vulnerability can be exploited by authenticated attackers to upload arbitrary files and execute code remotely on the affected websites.

When attacks were first spotted on May 6, this was a zero-day vulnerability, as attackers were already actively exploiting the flaw and a patch was not available for Elementor Pro users.

“An attacker able to remotely execute code on your site can install a backdoor or webshell to maintain access, gain full administrative access to WordPress, or even delete your site entirely,” Defiant explains.

Elementor released a patch for the vulnerability on May 7. Version 2.9.4 of Elementor Pro addresses the issue and users are advised to update immediately.

As part of the observed attacks, the threat actor is directly targeting the vulnerability on websites with open user registration.

If the site does not have user registration enabled, the attackers are attempting to exploit a recently patched vulnerability in the Ultimate Addons for Elementor plugin, which allows them to bypass registration and create subscriber accounts.

Next, leveraging the newly created accounts, the attackers are exploiting the Elementor Pro vulnerability to achieve remote code execution.

Ultimate Addons for Elementor version 1.24.2 addresses the registration bypass flaw and users are advised to update as soon as possible, especially if they use the plugin alongside Elementor Pro.

Admins are also advised to check their sites for any unknown subscriber-level users, and to search for files named “wp-xmlrpc.php” in their installations, which can be considered an indicator of compromise.

Furthermore, Defiant recommends deleting any unknown files or folders in the /wp-content/uploads/elementor/custom-icons/ directory, as these are a clear indicator of compromise, especially if a rogue subscriber-level account has also been created.