Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webcodin WCP Contact Form plugin <= 3.1.0 versions.

**Solution**

No fix 

No patched version is available. No reply from the vendor.

Le Ngoc Anh discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WCP Contact Form Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 3 present

 0 patched

View all

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-22703: WordPress WCP Contact Form plugin <= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

The privilege escalation flaw is one in thousands that researchers have disclosed in recent years.

WordPress plug-ins allow organizations to quickly extend the functionality of their websites without requiring any coding or advanced technical skills. But they have also been the biggest source of risk for website operators in recent years.

The newest example is a critical privilege escalation vulnerability in a plug-in that over 1 million WordPress websites use, called Essential Addons for Elementor Plugin. The vulnerability, tracked as CVE-2023-32243, affects versions 5.4.0 through 5.7.1 of the plug-in and allows an unauthenticated attacker to escalate privileges to that of any user on the WordPress site — including that of an administrator.

**Privilege Escalation Flaw**

Researchers at Patchstack discovered the vulnerability on May 8 and disclosed it to WPDeveloper, the author of Essential Addons for Elementor. WPDeveloper on May 11 released a new version of the software (version 5.7.2) that addresses the bug. The vendor described the new version as featuring a security enhancement in the login and register form for the software.

According to Patchstack, the bug has to do with Essential Addons' code resetting passwords without validating if the associated password reset keys are present and legitimate. This offers a way for an unauthenticated attacker to reset the password of any user on an affected WordPress site and login to their account.

"This vulnerability occurs because \[the\] password reset function does not validate a password reset key and instead directly changes the password of the given user," Patchstack said in a post.

The new bug is one among thousands of vulnerabilities that researchers have uncovered in WordPress plug-ins in recent years.

Patchstack counted 4,528 new vulnerabilities in WordPress plug-ins in 2022 alone, a startling 328% increase over the 1,382 it observed in 2021. Plug-ins accounted for 93% of the reported bugs in the WordPress environment in 2022. Just 0.6% of confirmed bugs were in the core WordPress platform itself. Some 14% of the bugs were of either high or critical severity.

**A Relentless Barrage of Flaws**

The trend has continued unabated this year. iThemes, a company that tracks WordPress plug-in flaws on a weekly basis counted 160 vulnerabilities just in the one-week period ending April 26. The bugs affected some 8 million WordPress websites, and only 68 of them had patches at vulnerability disclosure time.

Just last week, Patchstack reported on another privilege escalation vulnerability in a different WordPress plug-in (Advanced Custom Fields Plugins) that affected two million websites. The vulnerability gave attackers a way to both steal sensitive data from affected sites as well as escalate privileges on them.

In April, Sucuri reported on a campaign dubbed "Balada Injector," where a threat actor, over at least the past five years, has been systematically injecting malware into WordPress sites via vulnerable plug-ins. The security vendor assessed the threat actor behind the campaign had infected at least one million WordPress sites with malware that redirected site visitors to fake tech support sites, fraudulent lottery sites, and other scam sites.

Sucuri found the threat actor using newly disclosed vulnerabilities and, in some instances, zero-day bugs to launch massive attack waves against WordPress sites.

A lot of the attacker interest in the WordPress ecosystem has to do with its widespread use. Estimates on the exact number of WordPress sites worldwide vary widely with some pegging the number at upwards of 800 million. Technology survey website W3Techs, which some consider a reliable source for WordPress-related statistics, estimates that some 43% of all websites worldwide currently use WordPress.

According to Patchstack, the growing number of vulnerabilities that are being reported in the WordPress ecosystem isn't necessarily a sign that plug-in developers are getting sloppier. What it indicates rather is that security researchers are looking harder.

"This also means that the WordPress ecosystem is becoming more secure because a lot more of these security bugs are being addressed and patched," Patchstack said.

WordPress Plug-in Used in 1M+ Websites Patched to Close Critical Bug

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ApexChat plugin <= 1.3.1 versions.

**Solution**

No fix 

No patched version is available. No reply from the vendor.

Found this useful? Thank Yuki Haruma for reporting this vulnerability. Buy a coffee ☕

Yuki Haruma discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress ApexChat Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-28414: WordPress ApexChat plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Justin Saad Simple Tooltips plugin <= 2.1.4 versions.

**Solution**

No fix 

No patched version is available. No reply from the vendor.

deokhunKim discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Simple Tooltips Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 1 present

 1 patched

View all

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-25958: WordPress Simple Tooltips plugin <= 2.1.4 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodeSolz Easy Ad Manager plugin <= 1.0.0 versions.

**Solution**

No fix 

No patched version is available. No reply from the vendor.

Lokesh Dachepalli discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Easy Ad Manager Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-25460: WordPress Easy Ad Manager plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SnapOrbital Panorama plugin <= 1.5 versions.

**Solution**

Fixed 

Update the WordPress Panorama – WordPress Project Management Plugin plugin to the latest available version (at least 1.5.1).

Found this useful? Thank Rio Darmawan for reporting this vulnerability. Buy a coffee ☕

Rio Darmawan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Panorama – WordPress Project Management Plugin Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.5.1.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-23810: WordPress Panorama plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.2 versions.

**Solution**

Fixed 

Update the WordPress Category Specific RSS feed Subscription plugin to the latest available version (at least v2.3).

Found this useful? Thank yuyudhn for reporting this vulnerability. Buy a coffee ☕

yuyudhn discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Category Specific RSS feed Subscription Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version v2.3.

**Other vulnerabilities in this plugin**

 0 present

 3 patched

View all

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-22685: WordPress Category Specific RSS feed Subscription plugin <= v2.2 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gautam Thapar Button Builder – Buttons X plugin <= 0.8.6 versions.

**Solution**

No fix 

No patched version is available. No reply from the vendor.

Found this useful? Thank Lana Codes for reporting this vulnerability. Buy a coffee ☕

Lana Codes discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Button Builder – Buttons X Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-23867: WordPress Button Builder – Buttons X plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability - Patchstack

Black Hat Asia's NOC team gives a look inside what's really happening on the cyberfront during these events.

BLACK HAT ASIA – Singapore – When you're in an environment where the overwhelming majority of network traffic is classified as posing a severe cybersecurity threat, deciding what to be concerned about becomes not a needle in a haystack situation, but a needle in a needlestack problem.

That's the word this week at Black Hat Asia, where Neil Wyler, global lead of active threat assessments at IBM X-Force, and Bart Stump, senior systems engineer for NetWitness, took to the stage to give attendees a look inside the event's enterprise-grade network operations center (NOC). The duo oversaw the NOC's design and led the security team for the show, which ran from May 9-12. The multi-vendor network supported attendee Wi-Fi access; internal operations such as registration; the needs of business hall stands; and the communications requirements of technical trainings, briefings, keynotes, and vendor demonstrations.

"When we discuss the traffic, try to explain to others that at Black Hat it's bad all the time — all or most of the traffic is malicious," Wyler explained. "That sounds scary, but for this crowd that traffic is normal. There are people demoing attacks, there are red teams trainings going on, etc., and that means that we don't really block anything. We let that traffic fly because we don't want to take down a demo on stage or on the expo floor. Unless we see a direct attack on our infrastructure, say the registration system, we let it go."

So, in order to ferret out the actual bad, bad traffic, the NOC relies on a number of dashboards that allow a real-time view of everything flowing through the network, with the ability to capture stats on everything from device profiles to which cloud apps attendees are connecting to. It also captures raw packet data so NOC analysts can go back and rebuild sessions in the event something seems abnormally suspicious, to look at "every single thing someone is doing with every packet, in a way we can't using just logs," Wyler noted.

One of the more unusual dashboards put in place for the event offered a heat map of where Wi-Fi, Bluetooth, and even peer-to-peer wireless connections were being used, offering a quick look at where people were congregating and where there might be cyber issues afoot.

"It's an interesting perspective," explained Stump. "The bottom left corner of the map is actually the show floor, and after the business hall opened up, that got more red. You can see when breaks are happening and when they put the beverages out because people migrate. And overall, it's a quick visualization for us to see where potential issues might be coming from, where we should focus our attention."

    

_A heat map of where devices connected to the network._

In all, the NOC tracked 1,500 total unique devices connecting to the network across mobile phones, Internet of things (IoT) gear, and other endpoints, with DNS queries at their highest for the event since 2018. About three-quarters (72%) of that traffic was encrypted — a refreshingly high amount, the researchers noted. And interestingly, a domain called Hacking Clouds hosted the most user sessions — more even than the show's general Wi-Fi network for attendees.

In terms of the apps being used, TikTok made an appearance in the Top 10 for the first time, the team observed. Other top apps included Office 365 (no surprise there), Teams, Gmail, Facebook, and WhatsApp.

**Interesting NOC Happenings**

A few interesting incidents emerged from the data during the event, the duo noted. In one case, an individual was generating so much malicious activity that all of the NOC systems alerted at once.

"One particular person was so noisy that every NOC vendor partner saw their activity at the same time," Wyler said. "We're talking SQL injection on public-facing websites, WordPress compromises, lots and lots of scanning for vulnerabilities and open ports. It was like they learned something this week and went, 'Let me see if it works. I've heard about Log4j, let me see what's out there.' They took a training class and now they're spreading their wings and flying."

After the person moved from attacking restaurant chain websites to probing payment sites, it was clear the activity wasn't demo-related, so the team pinpointed the person and sent the individual a cease-and-desist email.

"We figured out they were sitting in the hallway looking out at the Bay, just attacking company after company after company," Wyler said. "We explained that it's still illegal to do what they're doing, so please discontinue attempting to execute vulnerabilities on public-facing websites. This is a violation of the Black Hat Code of Conduct and we will come find you if it doesn't stop — love, the NOC. They got that and everything stopped."

Other incidents involved VPN issues, including one that was transmitting the user's location information in clear text. The team captured the data, plugged it into Google Maps and generated a view of exactly where the person had been during the day.

    

_A VPN leak allowed the team to create a map of the user's location._

Yet another issue involved an endpoint detection and response (EDR) vendor that was sending all of the usage data it was collecting on the endpoints of its users in clear text back to its servers; one antivirus vendor was found sending unencrypted SMTP emails containing pricing quotes and other information in an unencrypted fashion, along with login credentials — allowing easy harvesting.

"An attacker could have pulled down quotes, changed quotes, gathered internal work information and customer information, definitely not good," said Stump. "It could be used to craft phishes or to manipulate pricing."

In all cases, the team worked with the problematic entities to resolve the issues. The NOC, quite simply, is on the case, according to Stump.

"People often say that at Black Hat, you shouldn't even get on the network because it's dangerous," said Stump. "But our goal is actually to leave attendees more secure than when they arrived. And that's why we do things like letting people know they're sending passwords in clear text, or when we see cryptomining activity, we'll alert them. We're committed to that."

'Very Noisy': For the Black Hat NOC, It's All Malicious Traffic All the Time

Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.

This blog post is about the Essential Addons for Elementor plugin vulnerability. If you’re a Essential Addons for Elementor user, please update the plugin to at least version **5.7.2**.

**Patchstack Developer and Business plan users are protected from the vulnerability.** You can also sign up for the Patchstack Community plan to be notified about vulnerabilities as soon as they become disclosed.

For plugin developers, we have security audit services and Threat Intelligence Feed API for hosting companies.

**About the Essential Addons for Elementor WordPress plugin**

The plugin Essential Addons for Elementor (versions >= **5.4.0** and <= **5.7.1**, free version), which has over 1 million active installations, is known as the most popular Elementor addons plugins in WordPress.

This WordPress plugin enhances the Elementor page building experience with 90+ creative elements and extensions. This plugin adds powers to our page builder using the easy-to-use elements those were designed to make our next WordPress page and posts design easier and prettier than ever before.

**The security vulnerability in Essential Addons for Elementor**

This plugin suffers from an unauthenticated privilege escalation vulnerability and allows any unauthenticated user to escalate their privilege to that of any user on the WordPress site.

It is possible to reset the password of any user as long as we know their username thus being able to reset the password of the administrator and login on their account. This vulnerability occurs because this password reset function does not validate a password reset key and instead directly changes the password of the given user. The described vulnerability was fixed in version **5.7.2** and assigned **CVE-2023-32243**.

Find out more from the Patchstack database

The start of discovering this vulnerability came from observing the init hook located in the register_hooks function:

    // Login | Register
    add_action('init', [$this, 'login_or_register_user']);

Let’s see the login_or_register_user function that will be triggered:

    public function login_or_register_user() {
        do_action( 'eael/login-register/before-processing-login-register', $_POST );
        // login or register form?
        if ( isset( $_POST['eael-login-submit'] ) ) {
            $this->log_user_in();
        } else if ( isset( $_POST['eael-register-submit'] ) ) {
            $this->register_user();
        } else if ( isset( $_POST['eael-lostpassword-submit'] ) ) {
            $this->send_password_reset();
        } else if ( isset( $_POST['eael-resetpassword-submit'] ) ) {
            $this->reset_password();
        }
        do_action( 'eael/login-register/after-processing-login-register', $_POST );
    
    }

The function will perform a couple of checks if certain $_POST parameter are set and will call the corresponding function. The underlying vulnerability is located in the reset_password function. Based on the official commit, the affected function only exists starting from version **5.4.0**.

    public function reset_password() {
        $ajax   = wp_doing_ajax();
        $page_id = 0;
        if ( ! empty( $_POST['page_id'] ) ) {
            $page_id = intval( $_POST['page_id'], 10 );
        } else {
            $err_msg = esc_html__( 'Page ID is missing', 'essential-addons-for-elementor-lite' );
        }
    
        $widget_id = 0;
        if ( ! empty( $_POST['widget_id'] ) ) {
            $widget_id = sanitize_text_field( $_POST['widget_id'] );
        } else {
            $err_msg = esc_html__( 'Widget ID is missing', 'essential-addons-for-elementor-lite' );
        }
    
        $rp_data = [
            'rp_key' => ! empty( $_POST['rp_key'] ) ? sanitize_text_field( $_POST['rp_key'] ) : '',
            'rp_login' => ! empty( $_POST['rp_login'] ) ? sanitize_text_field( $_POST['rp_login'] ) : '',
        ];
    
        update_option( 'eael_resetpassword_rp_data_' . esc_attr( $widget_id ), maybe_serialize( $rp_data ), false );
    
        update_option( 'eael_show_reset_password_on_form_submit_' . $widget_id, true, false );
    
        if (!empty( $err_msg )){
            if ( $ajax ) {
                wp_send_json_error( $err_msg );
            }
            update_option( 'eael_resetpassword_error_' . $widget_id, $err_msg, false );
    
            if (isset($_SERVER['HTTP_REFERER'])) {
                wp_safe_redirect($_SERVER['HTTP_REFERER']);
                exit();
            }
        }
    
        if ( empty( $_POST['eael-resetpassword-nonce'] ) ) {
            $err_msg = esc_html__( 'Insecure form submitted without security token', 'essential-addons-for-elementor-lite' );
            if ( $ajax ) {
                wp_send_json_error( $err_msg );
            }
            update_option( 'eael_resetpassword_error_' . $widget_id, $err_msg, false );
    
            if (isset($_SERVER['HTTP_REFERER'])) {
                wp_safe_redirect($_SERVER['HTTP_REFERER']);
                exit();
            }
        }
        if ( ! wp_verify_nonce( $_POST['eael-resetpassword-nonce'], 'essential-addons-elementor' ) ) {
            $err_msg = esc_html__( 'Security token did not match', 'essential-addons-for-elementor-lite' );
            if ( $ajax ) {
                wp_send_json_error( $err_msg );
            }
            update_option( 'eael_resetpassword_error_' . $widget_id, $err_msg, false );
    
            if (isset($_SERVER['HTTP_REFERER'])) {
                wp_safe_redirect($_SERVER['HTTP_REFERER']);
                exit();
            }
        }
        $settings = $this->lr_get_widget_settings( $page_id, $widget_id);
    
        if ( is_user_logged_in() ) {
            $err_msg = isset( $settings['err_loggedin'] ) ? __( Helper::eael_wp_kses( $settings['err_loggedin'] ), 'essential-addons-for-elementor-lite' ) : esc_html__( 'You are already logged in', 'essential-addons-for-elementor-lite' );
            if ( $ajax ) {
                wp_send_json_error( $err_msg );
            }
            update_option( 'eael_resetpassword_error_' . $widget_id, $err_msg, false );
    
            if (isset($_SERVER['HTTP_REFERER'])) {
                wp_safe_redirect($_SERVER['HTTP_REFERER']);
                exit();
            }
        }
    
        do_action( 'eael/login-register/before-resetpassword-email' );
    
        $widget_id = ! empty( $_POST['widget_id'] ) ? sanitize_text_field( $_POST['widget_id'] ) : '';
    
        // Check if password is one or all empty spaces.
        $errors = [];
        if ( ! empty( $_POST['eael-pass1'] ) ) {
            $post_eael_pass1 = trim( $_POST['eael-pass1'] );
    
            if ( empty( $post_eael_pass1 ) ) {
                $errors['password_reset_empty_space'] = isset( $settings['err_pass'] ) ? __( Helper::eael_wp_kses( $settings['err_pass'] ), 'essential-addons-for-elementor-lite' ) : esc_html__( 'The password cannot be a space or all spaces.', 'essential-addons-for-elementor-lite' );
            }
        } else {
            if ( empty( $_POST['eael-pass1'] ) ) {
                $errors['password_reset_empty_space'] = isset( $settings['err_pass'] ) ? __( Helper::eael_wp_kses( $settings['err_pass'] ), 'essential-addons-for-elementor-lite' ) : esc_html__( 'The password cannot be a space or all spaces.', 'essential-addons-for-elementor-lite' );
            }
        }
    
        if( ! empty( $_POST['eael-pass1'] ) && strlen( trim( $_POST['eael-pass1'] ) ) == 0 ){
            $errors['password_reset_empty'] = esc_html__( 'The password cannot be empty.', 'essential-addons-for-elementor-lite' );
        }
        
        // Check if password fields do not match.
        if ( ! empty( $_POST['eael-pass1'] ) && $_POST['eael-pass2'] !== $_POST['eael-pass1'] ) {
            $errors['password_reset_mismatch'] = isset( $settings['err_conf_pass'] ) ? __( Helper::eael_wp_kses( $settings['err_conf_pass'] ), 'essential-addons-for-elementor-lite' ) : esc_html__( 'The passwords do not match.', 'essential-addons-for-elementor-lite' );
        }
    
        if ( ( ! count( $errors ) ) && isset( $_POST['eael-pass1'] ) && ! empty( $_POST['eael-pass1'] ) ) {
            $rp_login = isset( $_POST['rp_login']) ? sanitize_text_field( $_POST['rp_login'] ) : '';
            $user = get_user_by( 'login', $rp_login );
            
            if( $user || ! is_wp_error( $user ) ){
                reset_password( $user, sanitize_text_field( $_POST['eael-pass1'] ) );
    -----------------------------------------------------------------------------------

First, we need to set a random value in $_POST['page_id'] and $_POST['widget_id'] so the $err_msg is not set. We also need to set $_POST['eael-resetpassword-nonce'] since the nonce value will be verified on the code. In order to set the password, we need to supply the same password string to $_POST['eael-pass1'] and $_POST['eael-pass2'] since it will be checked.

If we already pass all of above condition, the code will construct a $rp_login variable from $_POST['rp_login']. The code then will construct a $user object using the get\_user\_by function by searching the login (username) value that match the $rp_login variable.

If the $user object exists and there is no error, the code will directly reset the users’ password using the reset\_password function.

At this point the question is perhaps how we can get our hands on the essential-addons-elementor nonce value. Turns out that this nonce value is present in the main front-end page of the WordPress site since it will be set in the $this->localize_objects variable by the load_commnon_asset function:

    // localize object
    $this->localize_objects = apply_filters( 'eael/localize_objects', [
        'ajaxurl'            => admin_url( 'admin-ajax.php' ),
        'nonce'              => wp_create_nonce( 'essential-addons-elementor' ),

The $this->localize_objects variable will be used as the object on the wp\_localize\_script call in the frontend_asset_load function:

    public function frontend_asset_load() {
        $handle        = 'eael';
        $this->post_id = get_the_ID();
    
        $this->elements_manager->get_element_list( $this->post_id );
        $this->load_commnon_asset();
        $this->register_script();
    
    -------------------- CUTTED HERE ------------------------------------
    
        wp_localize_script( $handle, 'localize', $this->localize_objects );
    }

The function eventually will be called from init_hook and it will be set as a function handler of wp\_enqueue\_scripts hook that will display all of the enqueued scripts and styles.

    protected function init_hook() {
        add_action( 'wp_footer', [ $this, 'add_inline_js' ], 100 );
        add_action( 'wp_footer', [ $this, 'add_inline_css' ], 15 );
        add_action( 'after_delete_post', [ $this, 'delete_cache_data' ] );
    
        add_action( 'wp_enqueue_scripts', [ $this, 'frontend_asset_load' ], 100 );
        add_action( 'elementor/frontend/before_enqueue_styles', [ $this, 'ea_before_enqueue_styles' ] );
        add_action( 'elementor/theme/register_locations', [ $this, 'load_asset_per_location' ], 20 );
        add_filter( 'elementor/files/file_name', [ $this, 'load_asset_per_file' ] );
    }

Note that this vulnerability could be triggered on a default installation or configuration of the Essential Addons for Elementor plugin.

**The patch in Essential Addons for Elementor**

Since this vulnerability exists because the code directly resets a user password without properly checking if the password reset key is present and legitimate, the patch is pretty straight forward. The vendor decide to use the eael_resetpassword_rp_data_* value configured from eael_redirect_to_reset_password function to validate the reset password process. The patch can be seen below.

**Conclusion**

Keep in mind that unauthenticated users can execute the init and also admin\_init hooks on WordPress, so we need to add a proper access control and nonce check to the function handler if it contains a certain action that performs something that interacts with the database.

Also pay extra attention to anything that is related to the login, registration and password reset/recovery process. We highly recommend utilizing the check\_password\_reset\_key function to check for the reset password key.

**Disclosure timeline of the vulnerability**

**08 May, 2023** – We found the vulnerability and reached out to the plugin vendor.  
**11 May, 2023** – Essential Addons for Elementor version **5.7.2** was published to patch the reported issues.  
******11 May, 2023****** – Added the vulnerabilities to the Patchstack vulnerability database.  
******11 May, 2023****** – Published the article.

_Since we’ve detected that third-parties have had access to the vulnerability information via monitoring the changelog and have made the issue public, we’ve decided to disclose the vulnerability early._

**Help us make the Internet a safer place**

Making the WordPress ecosystem more secure is a team effort, and we believe that plugin developers and security researchers should work together.

*   If you’re a **plugin developer**, join our mVDP program that makes it easier to report, manage and address vulnerabilities in your software.
*   If you’re a **security researcher**, join Patchstack Alliance to report vulnerabilities & earn rewards.

Tag

#wordpress