Critical Vulnerability in Elementor Pro Plugin: Update Your WordPress Site

A vulnerability exists in file upload validation errors in the process_field and Upload::validation() functions. Under certain conditions, the validation process terminates prematurely, leaving uploaded files unchecked for file extensions and MIME types.cert

This could allow an unauthenticated attacker to upload a potentially executable file, bypassing the website's permitted file type restrictions. Depending on server configuration and the uploaded file's execution capabilities, the attack could result in remote code execution and complete WordPress site compromise.cert

Which sites are at risk?

The vulnerability can be exploited on websites where:

• Elementor Pro Form widget is used;

• a file upload field is configured in the form;

• the file upload field is not set as required.

Pay special attention to sites where visitors can upload documents, images, or other files.

What should site administrators do?

1. Update Elementor Pro to the latest available version as soon as possible.

2. Check for unknown or suspicious files on the site.

3. Review web server and WordPress logs, paying attention to unusual upload requests.

4. Check WordPress user accounts and remove unknown administrators or other suspicious accounts.

5. If the site could have been used in an attack, change administrator passwords and review API keys, access credentials, and other secrets.

6. If signs of compromise are detected, isolate the site and contact a security specialist.

Elementor Pro users should not rely solely on file extension checks. For additional protection, it is recommended to restrict uploadable file types, prevent executable files from being stored in publicly accessible directories, and use the latest versions of WordPress, plugins, and server software.

Source: CERT.LV advisory
Additional information: Patchstack analysis