CVE-2021-24359 The Plus Addons for Elementor Page Builder < 4.1.11 - Arbitrary Reset Pwd Email Sending
Attackers can send arbitrary password reset emails to users, potentially leading to account takeover when chained with an open redirect vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24359?
CVE-2021-24359 is a medium-severity authentication bypass vulnerability in Unknown The Plus Addons for Elementor Page Builder, published on 14 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
Which versions are affected by CVE-2021-24359?
It affects 1 product.
Products include Posimyth the Plus Addons for Elementor.
How do I fix CVE-2021-24359?
No fix has been published for CVE-2021-24359 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-24359 being exploited?
There is no known exploitation of CVE-2021-24359 in the wild and no public exploit code.
Other vulnerabilities in Unknown The Plus Addons for Elementor Page Builder
- CVE-2021-24949 The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL Injection
- CVE-2021-24175 The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass
- CVE-2024-5455 Path traversal in The Plus Addons for Elementor Page Builder Pro
- CVE-2021-4331 Privilege escalation in The Plus Addons for Elementor Page Builder Pro
- CVE-2023-47178 WordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerability
Sources
Also known as GHSA-37f5-h3rf-vphw.