Hackers exploit WordPress plugin flaw that gives full control of millions of sites

Posted April 1, 2023

In Biz & IT, content management system, exploits, plugin, vulnerabilities, wordpress

Hackers exploit WordPress plugin flaw that gives full control of millions of sites

Serving the Technologist for more than a decade. IT news, reviews, and analysis.

Hackers are actively exploiting a critical vulnerability in a widely used WordPress plugin that gives them the ability to take complete control of millions of sites, researchers said.

The vulnerability, which carries a severity rating of 8.8 out of a possible 10, is present in Elementor Pro, a premium plugin running on more than 12 million sites powered by the WordPress content management system. Elementor Pro allows users to create high-quality websites using a wide range of tools, one of which is WooCommerce, a separate WordPress plugin. When those conditions are met, anyone with an account on the site—say a subscriber or customer—can create new accounts that have full administrator privileges.

The vulnerability was discovered by Jerome Bruandet, a researcher with security firm NinTechNet. Last week, Elementor, the developer of the Elementor Pro plugin, released version 3.11.7, which patched the flaw. In a post published on Tuesday, Bruandet wrote:

Read 7 remaining paragraphs | Comments

Elementor Pro fixed the vulnerability, but not everyone has installed the patch.

Gavin Duvall