CVE CyberSecurity Database News

CVE-2024-4471 - Elementor Addon 140+ Widgets PHP Object Injection

Poster -

Hello Elementor users,

We've discovered a severe security vulnerability - CVE-2024-4471 - in the popular WordPress plugin, "140+ Widgets | Best Addons For Elementor". The plugin, available for free on the WordPress.org platform, is popular among website developers using the Elementor page builder for creating visually appealing WordPress sites.

*Info: Vulnerable versions*

If you are using a version of this plugin up to and including 1.4.3.1, your site could be exposed and at risk for PHP Object Injection attack. Versions prior to this might also be vulnerable.

*The Issue*

The vulnerability stems from the plugin's 'export_content' function, which is linked to the deserialization of untrusted input. This error potentially allows authenticated attackers, who may already have contributor-level or above permissions, to inject a harmful PHP Object into your website.

It is crucial to note that the vulnerable plugin does not contain a Property Oriented Programming (POP) chain. However, if any additional plugins or themes are already installed on your system with a POP chain, an attacker might exploit this vulnerability to delete arbitrary files, steal sensitive data (like user information), or even execute harmful code within your website environment.

*Code Snippet*

The vulnerable code within the plugin is found in the 'export_content' function, specifically this part:

$export_data = unserialize(stripslashes($_POST['export_content']));

This part of the code is responsible for deserializing the user input.

For the full details on this CVE, you can visit the official CVE database listing at CVE-2024-4471 as well as the advisory from the plugin developers Advisory Link.

Also, we highly recommend you review the WordPress official documentation on user roles and permissions, which can be found at this link: User Roles.

Execution of malicious code, which can severely harm your website's integrity and performance.

To prevent any of these attacks, the developers have already released an updated version of the plugin that addresses the vulnerability.

For your website's security, we highly recommend that you update your 140+ Widgets | Best Addons For Elementor plugin to the latest version as soon as possible, if you haven't already.

We also suggest regularly updating all other plugins and themes, as well as implementing strong user roles and permissions for your website's contributors.

Timeline

Published on: 05/23/2024 13:15:09 UTC
Last modified on: 06/04/2024 17:56:20 UTC