Medium severity6.5NVD Advisory· Published May 17, 2020· Updated Jun 17, 2026

CVE-2020-13125

Description

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.

Affected products

Brainstormforce/Ultimate Addons For Elementor
cpe:2.3:a:brainstormforce:ultimate_addons_for_elementor:*:*:*:*:*:wordpress:*:*
Range: <1.24.2
WordPress/Ultimate Addons for Elementordescription
WordPress/Ultimate Addons For Elementorllm-fuzzy
Range: <1.24.2
Package: https://wordpress.org/plugins/ultimate-addons-for-elementor

Patches

Vulnerability mechanics

References

www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk/nvdThird Party Advisory
wpvulndb.com/vulnerabilities/10214nvdNot Applicable

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000