Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

This top WordPress plugin had a security flaw that could let hackers hijack your site

Wordpress brand logo on computer screen. Man typing on the keyboard.

One of the most popular website builder plugins for WordPress carries a high-severity vulnerability that threat actors can use to take over the vulnerable website completely, researchers have warned.

Cybersecurity researcher Jerome Bruandet from NinTechNet said he discovered a flaw in Elementor Pro that allows an authenticated attacker to create an administrator account. That gives the attackers a range of possibilities, including one that’s being actively used - to redirect all traffic to an external malicious website. 

ArsTechnica reports that the traffic from compromised websites is being redirected to away[dot]trackersline[dot]com.

Critical vulnerability

WordPress security experts PatchStack also found some threat actors uploading malicious files to vulnerable websites, including wp-resortpack.zip, wp-rate.php, and lll.zip.

The vulnerability has been rated 8.8/10, earning the status “critical”. Users are advised to update Elementor Pro to 3.11.7, or later, as all older versions are vulnerable to the flaw. 

This is not the first time a high-severity flaw has been discovered in Elementor. In April last year, cybersecurity researchers from Wordfence found a flaw that allowed any authenticated user to upload arbitrary PHP code. Back then, the plug-in was in version 3.6.0, which introduced a new Onboarding module. The goal of the module was to simplify the plug-in’s initial setup, but it came with an “unusual” method to register AJAX actions, with no capability checks.

Consequently, any logged-in user could use any of the onboarding functions. That being said, an attacker could, for example, create a malicious “Elementor Pro” plugin zip, and use the onboarding functions to install it. The site would then execute any code present in the plugin, including code designed to take over the site, or access additional resources on the server. The functions could also be used to completely deface the site, researchers were saying at the time.

Today, Elementor Pro is used by more than 12 million websites, ArsTechnica concludes.

Via: ArsTechnica

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.