nuclei-templates/http/cves/2023/CVE-2023-32243.yaml

id: CVE-2023-32243

info:
  name: WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset
  author: Vikas Kundu, DhiyaneshDK
  severity: critical
  description: |
    Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-32243
    - https://patchstack.com/articles/critical-privilege-escalation-in-essential-addons-for-elementor-plugin-affecting-1-million-sites?_s_id=cve
    - https://github.com/RandomRobbieBF/CVE-2023-32243/blob/main/exploit.py
    - https://wordpress.org/plugins/essential-addons-for-elementor-lite/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-32243
    cwe-id: CWE-287
  metadata:
    max-request: 3
    verified: true
    google-query: inurl:/wp-content/plugins/essential-addons-for-elementor-lite
  tags: cve,cve2023,wordpress,wp,wp-plugin,auth-bypass,intrusive

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /wp-content/plugins/essential-addons-for-elementor-lite/readme.txt HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: regex
        name: elementor-version
        part: body
        regex:
          - 'front-end/css/view/general\.min\.css\?ver=(5\.[4-6]\.\d+)'
          - 'front-end/css/view/general\.min\.css\?ver=(5\.7\.[0-1])'
          - 'Stable tag:\s*(5\.[4-6]\.\d+)'
          - 'Stable tag:\s*(5\.7\.[0-1])'
        condition: or