Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin

The blog post discusses a critical security vulnerability found in the Elementor Pro plugin for WordPress, which allows unauthenticated attackers to upload arbitrary files (including PHP scripts) to the server. Here's a summary of the key points:

1. Vulnerability Details:

   • The vulnerability is an Unauthenticated Arbitrary File Upload issue.
   • It affects all versions up to and including 4.2.1 of Elementor Pro.

2. Technical Explanation:

   • The flaw lies in how the plugin validates file uploads for a specific field type (File Upload).
   • When uploading files, if one entry is empty (UPLOAD_ERR_NO_FILE), the validation function prematurely returns without checking subsequent entries.
   • This allows an attacker to bypass validation by submitting an array with an empty first part and a malicious second part.

3. Exploitation Process:

   • An attacker can upload a PHP file disguised as another type (e.g., .php extension) due to the flawed validation logic.
   • The uploaded file is stored in the /wp-content/uploads/elementor/forms/ directory, allowing remote code execution if accessed.

4. Wordfence Protection:

   • Wordfence's firewall

Read the full article at Wordfence

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.