Stating the details in a blog post, the researchers highlighted that a critical severity bug existed in the Elementor Pro plugin. Exploiting the bug allowed remote code execution attacks as any registered user could upload arbitrary files. As explained by the researchers,
An attacker able to remotely execute code on your site can install a backdoor or webshell to maintain access, gain full administrative access to WordPress, or even delete your site entirely.It was a zero-day vulnerability as it caught the attention of hackers before the developers.
While the hackers could exploit this bug directly on sites “with open user registration”, they also had an option to exploit this bug even for websites with this option disabled.
In the latter case, they could exploit a registration bypass vulnerability in another plugin Ultimate Addons for Elementor.
As this is an active attack, we wanted to alert you so that you can take steps to protect your site. We are intentionally limiting the amount of information this post provides, because this is an ongoing attack.Although, the developers behind both plugins have patched the flaws. Hence, the users should ensure updating their websites to Elementor Pro version 2.9.4, and Ultimate Addons for Elementor version 1.24.2 or higher.
Moreover, the researchers have also recommended the following to make sure that the website remains uncompromised.
-Check for any unknown subscriber-level users on your site. - Check for files named “wp-xmlrpc.php.” - Delete any unknown files or folders found in /wp-content/uploads/elementor/custom-icons/ directory.Let us know your thoughts in the comments.
