Unauthenticated Access to WooCommerce Downloads in ElementsReady Addons

Executive Summary

The ElementsReady Addons for Elementor WordPress plugin through version 6.7.2 has a flaw where unauthenticated users can bypass payment requirements to access protected WooCommerce product downloads. This happens due to improper access control in the 'downloadtype' parameter, allowing unauthorized retrieval of paid files.

Useful 0 Not Useful 0

Detection Guidance

Check if the ElementsReady Addons for Elementor plugin version is 6.7.2 or below. Look for unauthorized access to WooCommerce downloadable files without payment. Monitor network traffic for unusual requests to download endpoints.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated users could download paid digital products without paying, leading to lost revenue for store owners. Website operators may face increased bandwidth usage and potential legal issues if digital goods are distributed without authorization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access to paid downloadable files, which could lead to exposure of sensitive data such as personal or health information if those files contain such data. This may violate compliance requirements under GDPR (if personal data is involved) or HIPAA (if protected health information is exposed), as unauthorized access to sensitive files can result in data breaches and non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the ElementsReady Addons for Elementor plugin to the latest version if available. If no update exists, consider disabling the plugin temporarily until a patch is released. Restrict access to WooCommerce downloadable files and review server logs for suspicious activity.

Useful 0 Not Useful 0