Critical · 9.9 CVE-2020-13126 EUVD-2020-5402GHSA-q42j-4cv4-vf65

An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CV…

Published May 17, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Description

An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.

References

https://wpvulndb.com/vulnerabilities/10214
https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk/