Pierluigi Paganini
May 12, 2023
Essential ‘Addons for Elementor’ WordPress plugin is a collection of 90+ creative elements and extensions Enhance that allow admins to enhance Elementor page building experience.
The plugin has more than one million active installations.
Researchers from PatchStack discovered that the plugin is affected by an unauthenticated privilege escalation issue, tracked as CVE-2023-32243, that can allow remote attackers to gain administrator rights on the website.
The vulnerability resides in the plugin’s password reset functionality, it impacts versions 5.4.0 to 5.7.1. The flaw was addressed with the release of the version 5.7.2.
“This plugin suffers from an unauthenticated privilege escalation vulnerability and allows any unauthenticated user to escalate their privilege to that of any user on the WordPress site.” reads the advisory published by PatchStack. “It is possible to reset the password of any user as long as we know their username thus being able to reset the password of the administrator and login on their account. This vulnerability occurs because this password reset function does not validate a password reset key and instead directly changes the password of the given user.”
The root cause of the issue is that the code fails to properly check if the password reset key is present and legitimate during the user password reset process. Clearly, in order to exploit the issue the remote attackers need to know a username of an existing user on the system to carry out a password reset.
“First, we need to set a random value in $_POST[‘page_id’] and $_POST[‘widget_id’] so the $err_msg is not set. We also need to set $_POST[‘eael-resetpassword-nonce’] since the nonce value will be verified on the code. In order to set the password, we need to supply the same password string to $_POST[‘eael-pass1’] and $_POST[‘eael-pass2’] since it will be checked. If we already pass all of above condition, the code will construct a $rp_login variable from $_POST[‘rp_login’].” continues the analysis. “The code then will construct a $user object using the get_user_by function by searching the login (username) value that match the $rp_login variable. If the $user object exists and there is no error, the code will directly reset the users’ password using the reset_password function.”
The essential-addons-elementor nonce value could be retrieved from the main front-end page of the site since it will be set in the $this->localize_objects variable by the load_commnon_asset function.
The exploitation of the flaw can allow attackers to take over the website and use it for malicious purposes, including malware distribution or traffic redirection.
We are in the final!
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini
Please nominate Security Affairs as your favorite blog.
Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, WordPress)
