Hackers are actively exploiting a critical vulnerability in a widely used WordPress plugin that gives them full control over millions of websites, researchers say.

A vulnerability with a severity rating of 8.8 out of 10 is present in Elementor Pro, premium plugins Powered by over 12 million websites powered by the WordPress content management system Elementor Pro allows users to create high quality websites using a wide range of tools, one of which is WooCommerce, a standalone WordPress plugin. When these conditions are met, anyone with an account on the site – such as a subscriber or customer – can create new accounts with full administrator rights.

The vulnerability was discovered by Jerome Bruande, a researcher at security company NinTechNet. Last week Elementor, developer of the Elementor Pro plugin, released version 3.11.7 which fixed the vulnerability. V mail published Tuesday, Bruande wrote:

An authenticated attacker could use the vulnerability to create an administrator account by enabling logging (users_can_register) and setting the default role (default_role) to “administrator”, change the admin email address (admin_email) or, as shown below, redirect all traffic to an external malicious website by changing siteurl among many other possibilities:

MariaDB [example]> SELECT * FROM `wp_options` WHERE `option_name`='siteurl';
+-----------+-------------+------------------+----------+
| option_id | option_name | option_value     | autoload |
+-----------+-------------+------------------+----------+
|		 1 | siteurl     | https://evil.com | yes 	 |
+-----------+-------------+------------------+----------+
1 row in set (0.001 sec)

Now researchers from a separate security firm, PatchStack, report that the vulnerability is being actively exploited. Attacks come from different IP addresses, including:

• 193.169.194.63
• 193.169.195.64
• 194.135.30.6

Files uploaded to hacked sites often have the following names:

• wp-resortpack.zip
• wp-rate.php
• lll.zip

The URLs of compromised sites often change to:

• away[dot]trackers[dot]com

The broken access control vulnerability is related to the use of Elementor Pro component “elementor-pro/modules/woocommerce/module.php”. When WooCommerce is running, this script registers the following AJAX actions:

/**
 * Register Ajax Actions.
 *
 * Registers ajax action used by the Editor js.
 *
 * @since 3.5.0
 *
 * @param Ajax $ajax
 */
public function register_ajax_actions( Ajax $ajax ) {
   // `woocommerce_update_page_option` is called in the editor save-show-modal.js.
   $ajax->register_ajax_action( 'pro_woocommerce_update_page_option', [ $this, 'update_page_option' ] );
   $ajax->register_ajax_action( 'pro_woocommerce_mock_notices', [ $this, 'woocommerce_mock_notices' ] );
}

another

/**
 * Update Page Option.
 *
 * Ajax action can be used to update any WooCommerce option.
 *
 * @since 3.5.0
 *
 * @param array $data
 */
public function update_page_option( $data ) {
   update_option( $data['option_name'], $data['editor_post_id'] );
}

The update_option function “is supposed to allow an admin or store manager to update some specific WooCommerce options, but user input is not validated and the function lacks capability checking to limit its access to a highly privileged user,” Bruande explained. He continued:

Elementor uses its own AJAX handler to manage most of its AJAX actions, including pro_woocommerce_update_page_optionwith global elementor_ajax action. It is in the “elementor/core/common/modules/ajax/module.php” script of the free version (which is required to run Elementor Pro):

/**
 * Handle ajax request.
 *
 * Verify ajax nonce, and run all the registered actions for this request.
 *
 * Fired by `wp_ajax_elementor_ajax` action.
 *
 * @since 2.0.0
 * @access public
 */
public function handle_ajax_request() {
   if ( ! $this->verify_request_nonce() ) {
  	$this->add_response_data( false, esc_html__( 'Token Expired.', 'elementor' ) )
     	->send_error( Exceptions::UNAUTHORIZED );
   }
   ...

Anyone using Elementor Pro should make sure they have version 3.11.7 or later as all previous versions are vulnerable. These users are also encouraged to check their sites for signs of infection listed in the PatchStack message.