CVE-2022-1329
Description
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
Severity: HIGH
CVE ID: CVE-2022-1329
CVSS Score: 8.8
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Proof Of Concept
Nuclei Templates for CVE-2022-1329
Refrence: Project Discovery GitHub
AkuCyberSec
Refrence: GitHub
mcdulltii
WordPress Elementor 3.6.0 3.6.1 3.6.2 RCE POC
Refrence: GitHub
Grazee
Refrence: GitHub
dexit
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to o CVE project by @Sn0wAlice
Refrence: GitHub