This top WordPress plugin had a security flaw that could let hackers hijack your site

Wordpress brand logo on computer screen. Man typing on the keyboard.
(Image credit: Shutterstock/David MG)

One of the most popular website builder plugins for WordPress carries a high-severity vulnerability that threat actors can use to take over the vulnerable website completely, researchers have warned.

Cybersecurity researcher Jerome Bruandet from NinTechNet said he discovered a flaw in Elementor Pro that allows an authenticated attacker to create an administrator account. That gives the attackers a range of possibilities, including one that’s being actively used - to redirect all traffic to an external malicious website. 

ArsTechnica reports that the traffic from compromised websites is being redirected to away[dot]trackersline[dot]com.

Critical vulnerability

WordPress security experts PatchStack also found some threat actors uploading malicious files to vulnerable websites, including wp-resortpack.zip, wp-rate.php, and lll.zip.

The vulnerability has been rated 8.8/10, earning the status “critical”. Users are advised to update Elementor Pro to 3.11.7, or later, as all older versions are vulnerable to the flaw. 

This is not the first time a high-severity flaw has been discovered in Elementor. In April last year, cybersecurity researchers from Wordfence found a flaw that allowed any authenticated user to upload arbitrary PHP code. Back then, the plug-in was in version 3.6.0, which introduced a new Onboarding module. The goal of the module was to simplify the plug-in’s initial setup, but it came with an “unusual” method to register AJAX actions, with no capability checks.

Consequently, any logged-in user could use any of the onboarding functions. That being said, an attacker could, for example, create a malicious “Elementor Pro” plugin zip, and use the onboarding functions to install it. The site would then execute any code present in the plugin, including code designed to take over the site, or access additional resources on the server. The functions could also be used to completely deface the site, researchers were saying at the time.

Today, Elementor Pro is used by more than 12 million websites, ArsTechnica concludes.

Via: ArsTechnica

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
Another serious WordPress plugin vulnerability could put 40,000 sites at risk of attack
WordPress
WordPress users beware - these popular theme plugins have some major security issues
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
Over a million WordPress sites exposed to attack from W3 Total Cache plugin flaw
WordPress
Another top WordPress plugin found carrying critical security flaws
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
Thousands of WordPress websites hit in new malware attack, here's what we know
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
This top WordPress plugin could be hiding a worrying security flaw, so be on your guard
Latest in Security
Microsoft
"Another pair of eyes" - Microsoft launches all-new Security Copilot Agents to give security teams the upper hand
Lock on Laptop Screen
Medusa ransomware is able to disable anti-malware tools, so be on your guard
An abstract image of digital security.
Fake file converters are stealing info, pushing ransomware, FBI warns
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
Coinbase targeted after recent Github attacks
hacker.jpeg
Key trusted Microsoft platform exploited to enable malware, experts warn
IBM office logo
IBM to provide platform for flagship cyber skills programme for girls
Latest in News
Microsoft
"Another pair of eyes" - Microsoft launches all-new Security Copilot Agents to give security teams the upper hand
Cassian Andor looking nervously over his shoulder in Andor season 2
New Andor season 2 trailer has got Star Wars fans asking the same question – and it includes an ominous call back to Rogue One's official teaser
Ncuti Gatwa as The Fifteenth Doctor in Doctor Who
Disney+ drops new trailer for Doctor Who season 2 that promises an epic adventure across time and space
23andMe
23andMe is bankrupt and about to sell your DNA, here's how to stop that from happening
A phone showing a ChatGPT app error message
ChatGPT was down for many – here's what happened
AirPods Max with USB-C in every color
Apple's AirPods Max with USB-C will get lossless audio in April, but you'll need to go wired