CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HTML for custom widgets This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary commands on the server.
Explanation of Vulnerability in Simple Terms
Unlimited Elements For Elementor versions up to 1.5.102 contain an OS command injection vulnerability. An authenticated administrator can execute arbitrary system commands on the server by sending a specially crafted request. This allows complete compromise of the site and underlying server. Update to a version newer than 1.5.102 immediately.
What an attacker can do
Run arbitrary system commands on the server with the privileges of the web server process.
Potential impact on your site
A compromised admin account can execute code on your server, potentially leading to data theft, malware installation, or complete site takeover.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
