CVE-2023-32243 WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation

What is CVE-2023-32243?

CVE-2023-32243 is a critical vulnerability in Wpdeveloper Essential Addons for Elementor, published on 12 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.

Weakness: CWE-287

Which versions are affected by CVE-2023-32243?

It affects 1 product.

Products include Wpdeveloper Essential Addons for Elementor.

How do I fix CVE-2023-32243?

No fix has been published for CVE-2023-32243 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-32243 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-32243 exists.

Public exploit code: 1 Nuclei template and 8 proofs of concept on GitHub.

Other vulnerabilities in Wpdeveloper Essential Addons for Elementor

• CVE-2022-0320 Essential Addons for Elementor < 5.0.5 - Unauthenticated LFI Critical 9.8
• CVE-2021-4447 Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation High 8.8
• CVE-2023-41955 WordPress Essential Addons for Elementor plugin <= 5.8.8 - Contributor+ Privilege Escalation vulnerability High 8.8
• CVE-2024-3018 Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword High 8.8
• CVE-2024-8979 Information disclosure in Essential Addons for Elementor – Popular Elementor Templates & Widgets High 8.0

All Wpdeveloper Essential Addons for Elementor vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4xm5-cg4q-prrp.