Question 1

What is the Elementor Addon Elements plugin?

Accepted Answer

What is the Elementor Addon Elements plugin?

Elementor Addon Elements is a popular WordPress plugin with over 2 million downloads. It provides additional widgets, templates and functionality to extend the Elementor page builder plugin. The plugin helps users build custom WordPress pages and posts using Elementor more easily.

Question 2

What versions of Elementor Addon Elements are affected?

Accepted Answer

What versions of Elementor Addon Elements are affected?

The vulnerability affects all versions of Elementor Addon Elements up to and including version 1.12.7. Any site running the plugin on a version in that range is vulnerable.

Question 3

What is the nature of this vulnerability?

Accepted Answer

What is the nature of this vulnerability?

It is a cross-site request forgery (CSRF) vulnerability. This means attackers could potentially modify the plugin's settings without authorization if they can trick an admin into clicking a malicious link. It allows forged requests due to improper validation.

Question 4

How serious is this vulnerability?

Accepted Answer

How serious is this vulnerability?

While not extremely critical, it does pose a moderate security risk with a CVSS severity score of 5.4 out of 10. Attackers could potentially modify settings or insert bad code.

Question 5

How can I tell if my site is already affected?

Accepted Answer

How can I tell if my site is already affected?

Review your plugin's settings for any unauthorized changes. If something looks modified without your knowledge, your site may have already been compromised.

Question 6

What can attackers actually do by exploiting this?

Accepted Answer

What can attackers actually do by exploiting this?

The main risk is changing settings or inserting malicious code in the plugin's configuration. This depends on what the attacker aims to achieve, but could lead to inserted spam or malware.

Question 7

How do I update Elementor Addon Elements to patch it?

Accepted Answer

How do I update Elementor Addon Elements to patch it?

Simply update to version 1.12.8 or higher, available from your WordPress dashboard. This release addresses the vulnerability with proper validation.

Question 8

Should I find an alternate plugin?

Accepted Answer

Should I find an alternate plugin?

You may want to consider alternate page builder plugins as a precaution, like Beaver Builder or WPBakery. But the patched release should secure Elementor Addon Elements.

Question 9

Why is it important to update plugins promptly?

Accepted Answer

Why is it important to update plugins promptly?

Leaving vulnerabilities like this unpatched puts your site at unnecessary risk. Prompt updates are crucial for security, as this plugin has now had 9 vulnerabilities disclosed since 2020.

Question 10

What if I don't have time to handle updates manually?

Accepted Answer

What if I don't have time to handle updates manually?

Consider using a managed WordPress host or maintenance service to automatically handle updates for you in the background. This takes the work out of update maintenance.

CVE-2023-4690

WordPress Plugin Vulnerability Report – Elementor Addon Elements – Cross-Site Request Forgery – CVE-2023-4690

Recent Blog Posts

LiteSpeed Cache Vulnerability – Unauthenticated Sensitive Information Exposure via Log Files – CVE-2024-44000 | WordPress Plugin Vulnerability Report

Elementor Addon Elements Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters – CVE-2024-4401, CVE-2024-7122 | WordPress Plugin Vulnerability Report

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Vulnerability – Authenticated (Contributor+) Information Disclosure – CVE-2024-7418 | WordPress Plugin Vulnerability Report

Additional Resources

About Your WP Guy