DynamicKit for Elementor Password Reset Host Validation Bypass

Executive Summary

This vulnerability exists in the DynamicKit for Elementor WordPress plugin before version 1.0.3. It fails to validate the host of a user-supplied URL used as the base for password-reset links. Attackers can exploit this by sending a victim a legitimate-looking reset email with a link pointing to an attacker-controlled host while carrying a valid reset key. When the victim clicks the link, it leads to account takeover.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the DynamicKit for Elementor plugin is installed and verify its version. If it is below 1.0.3, it is vulnerable. Inspect WordPress email templates for password reset links to see if they use user-supplied URLs without host validation.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected DynamicKit for Elementor plugin, an attacker could trick you into clicking a malicious password-reset link. This could allow them to gain control of your WordPress account, potentially leading to unauthorized access to your site, data theft, or further attacks on your users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user accounts, potentially exposing personal data. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if user data is compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Update the DynamicKit for Elementor plugin to version 1.0.3 or later to address the vulnerability.

Useful 0 Not Useful 0