A high severity vulnerability in WordPress plugin Elementor Pro has been found to be actively exploited. The plugin WooCommerce must also be running on the same site in order for this exploit to take place. The payment plugin WooCommerce was force-updated in March to patch a critical vulnerability that let unauthenticated attackers gain admin access to the site. However, despite that fix, WooCommerce is still able to be manipulated through this Elementor Pro plugin, which affects Elementor Pro version 3.11.6 and all previous versions. 

This broken access control vulnerability has not had a CVE assigned, but has been rated as high severity, with a CVSS base score of 8.8 by WordPress’s security firm PatchStack. When both Elementor Pro and WooCommerce plugins are being run on a site, a php component elementor-pro/modules/woocommerce/module.php is loaded, which triggers a number of AJAX actions. One of these AJAX actions, pro_woocommerce_update_page_option, causes an update_option function to be called. This function has the ability to modify the WordPress database which allows it to update specific WooCommerce options, however these user inputs are not validated, and access restriction to a high privilege user only is not checked by the function. Because this privilege control is not in place, an attacker exploiting this flaw can update any setting on the site through any authenticated user login such as a subscriber or customer user role. From this they can enable a registration page and set the default user to an administrator role, allowing them to continue to exploit this site with full admin access. An in-depth analysis of this exploit has been published by NinTechNet, the threat researchers who first identified this flaw.  

To patch this vulnerability, users can update their site to use Elementor Pro version 3.11.7 or higher. A full list of Elementor Pro version updates can be found on their website, which is also true for WooCommerce versions and updates. The IP addresses from which the known exploits have taken place have been identified and published by PatchStack. Users should ensure their sites including all plugins are fully up to date to avoid falling victim to these attacks.