Auth bypass in The Plus Addons For Elementor Page Builder
CVE-2021-24175
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing…
Vulnerability class: Broken Authentication
EPSS: 0.896 (99.6th percentile) — read the EPSS interpretation.
Affected products
- Unknown The Plus Addons For Elementor Page Builder — versions 4.1.7
Weakness classification (CWE)
Public proof-of-concept exploits
References
- wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89 (x_refsource_CONFIRM)
- www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-… (x_refsource_MISC)
- posimyth.ticksy.com/ticket/2713734/ (x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-24175?
- CVE-2021-24175 is a vulnerability in The Plus Addons For Elementor Page Builder, classified under Improper Authentication. Published 2021-04-05.
- Is CVE-2021-24175 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.