WordPress is today the most widely used CMS for building websites. Millions of sites worldwide are now built on this platform. However, WordPress is not a perfect tool, and as with other popular platforms, it can sometimes be exposed to serious threats. One such threat is a security vulnerability in a plugin that allows remote code execution (RCE).
What Is WordPress Elementor?
As already mentioned, WordPress is a no-code platform for building websites — in other words, a CMS. Its system is built around an intuitive interface, and its greatest strength is the ability to install additional plugins that significantly expand what your site can do. One of the most popular of these plugins is Elementor, whose main purpose is to make it easier to build websites, especially for beginners. It comes in two versions: free and paid. The paid, licensed version offers a much wider range of features and functionality, with significantly more elaborate ready-made block elements. The main benefits of installing this plugin are a simpler workflow, thanks to the clean and intuitive page-editor interface, and a rich library of ready-made templates that are enough to get started building and editing a page. For everything to run smoothly, it’s worth investing in proper WordPress hosting, since hosting quality is what ultimately determines whether a site runs fast and functions well online.
What Is the Essential Addons Plugin Vulnerability?
The popular Essential Addons for Elementor plugin has a critical remote code execution (RCE) vulnerability in version 5.0.4 and earlier. The flaw allows an unauthenticated attacker to carry out an attack that chains local files, such as a PHP file, to execute code on the site. The bug in the plugin stemmed from how files were included based on the way user input was passed into PHP’s include function, which is used by the ajax_load_more and ajax_eael_product_gallery functions. As a result, the only precondition for the attack is having the Dynamic Gallery and Product Gallery widgets enabled. It’s worth noting that an estimated one million WordPress sites may have been affected by this critical RCE vulnerability, since that is roughly how many sites had downloaded the extension.
Attempts to Fix It
As soon as the vulnerability was discovered, efforts began to fix it. Two WordPress plugin updates failed to eliminate the flaw, and it was only version 5.0.5 that actually resolved the problem. Many sites updated their plugin automatically, but for a long time afterward it was still possible to find sites online still running version 5.0.3, 5.0.4, or earlier. Anyone using Essential Addons for Elementor can secure their site by updating the plugin, and this can be done in one of two ways: downloading the latest update from the notification that appears, or going to the WordPress dashboard manually and running the update from there.
The 5.0.3 update attempted to fix the issue by adding the “sanitize_text_field” function to user input. This didn’t produce the expected results, though, and local file inclusion was still possible. The second attempt, version 5.0.4, introduced the “sanitize_file_name” function, intended to strip special characters such as dots and slashes that were meant to “clean” the text. The vulnerability was finally closed in version 5.0.5, which implemented PHP’s “realpath” function. That version was released on January 28, 2022.
WordPress plugins are an increasingly common target for cybercriminals, who mainly exploit vulnerabilities in their security. Fortunately, in most cases plugin developers respond quickly by releasing new updates. This is one of the strongest arguments for why keeping software updated is so important in the world of cybersecurity.