Arbitrary PHP Code Execution in ElementsKit Elementor Addons

Executive Summary

The ElementsKit Elementor Addons WordPress plugin before version 3.10.01 has a flaw where custom-widget definitions saved by administrators are written directly into a PHP file without proper sanitization. This allows arbitrary PHP code to be executed on the server when the plugin runs the file. In multisite setups, non-super subsite administrators can exploit this to gain host-level code execution beyond their granted permissions.

Useful 0 Not Useful 0

Detection Guidance

Check if the ElementsKit Elementor Addons plugin version is below 3.10.01. Look for unauthorized PHP files in the plugin's generated directories or suspicious code in custom-widget definitions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with administrative access to execute arbitrary PHP code on the server. In a multisite WordPress environment, non-super subsite administrators can bypass restrictions and gain elevated privileges, potentially compromising the entire server. Attackers could install malware, steal data, or take control of the website.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguarding protected health information. Exploitation may result in regulatory penalties, legal liabilities, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the ElementsKit Elementor Addons plugin to version 3.10.01 or later immediately. Remove any unauthorized PHP files or suspicious code from custom-widget definitions.

Useful 0 Not Useful 0