CVE-2023-48777 WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability
An attacker can upload malicious files to the Elementor Website Builder plugin, potentially leading to remote code execution on the WordPress site.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-48777?
CVE-2023-48777 is a critical vulnerability in Elementor.com Elementor Website Builder, published on 26 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3.0 through 3.18.1.
Weakness: CWE-434
Which versions are affected by CVE-2023-48777?
It affects 1 product.
Products include Elementor Website Builder.
How do I fix CVE-2023-48777?
No fix has been published for CVE-2023-48777 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-48777 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-48777 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Elementor.com Elementor Website Builder
- CVE-2020-7109 Cross-site scripting in n/a
- CVE-2022-1329 Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution
- CVE-2024-24934 WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability
- CVE-2023-0329 Elementor Website Builder < 3.12.2 - Admin+ SQLi
- CVE-2024-54444 WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability
Sources
Also known as GHSA-vrwg-q62p-8qvc.