One of the most popular WordPress plugins, Elementor Pro, used by over eleven million websites, is vulnerable to a high-severity vulnerability that hackers have actively exploited.
More than 12 million sites powered by WordPress have been affected by the vulnerability, which carries a severity rating of 8.8 out of 10.
Elementor Pro is a plugin that allows users to build professional-looking websites without knowing how to code. It provides drag-and-drop functionality like:-
This critical vulnerability occurred in Elementor Pro version 3.11.6. It does, however, allow any authenticated user to update any WordPress setting that has been set on the site.
To accomplish this, an AJAX action within Elementor Pro is used that does not have the proper privilege control in place.
The vulnerability affects versions 3.11.6 and the below of the plugin. As a result, malicious users can set the default role of the user account to administrate on the registration page, which instantly grants them administrator rights.
So, it’s strongly recommended that users must update their Elementor Pro plugin to version 3.11.7, released on March 22, 2023, in conjunction with the WooCommerce plugin running on the site.
Using the vulnerability in the Elementor Pro plugin, hackers redirect visitors to malicious domains or upload backdoors to the compromised website.
According to PatchStack, the following malicious files were uploaded that were used in the attack, and the files are named:-
As a result of this backdoor, the attacker could gain full access to the WordPress site, whether to steal data or install additional malicious software.
Adding the following IP addresses to a blocklist is recommended to help prevent attacks targeting vulnerable websites.
The majority of attacks targeting vulnerable websites originate from these three IP addresses:-
On March 18, 2023, NinTechNet researcher Jerome Bruandet discovered this vulnerability. He shared technical details on how it can be exploited using WooCommerce.
There is an issue with v3.11.6 and all previous versions that allow authenticated users to change the site’s settings and even take over the entire site by changing the site’s settings or doing a complete makeover.
By enabling registration and setting the default role to “administrator,” an authenticated attacker may be able to create an administrator account by exploiting the vulnerability.
While changing the administrator’s email address and redirecting all traffic to an external malicious site could also be performed by the threat actor.
Even in some cases, security analysts have also observed that the URLs are being changed to:-
So, update your Elementor Pro on your website as soon as possible since hackers are already attacking vulnerable websites due to the lack of updates.
Building Your Malware Defense Strategy – Download Free E-Book
Related Read:
Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…
Hackers are making some phishing pages harder to track by changing the code delivered to…
A cyber incident reportedly forced a British power plant to halt operations for about four…
Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…
TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…
A fake student resume is being used to place a remote-access tool on researchers’ Windows…