CVE-2024-43281

Vulnerability

Overview

The Void Elementor Post Grid Addon for Elementor Page Builder plugin for WordPress, in versions up to and including 2.3, contains a path traversal vulnerability. This flaw arises from improper limitation of a pathname to a restricted directory, enabling an attacker to perform PHP local file inclusion. The vulnerability is classified as a Path Traversal (CWE-22) and has been assigned a CVSS v3 score of 5.3 (Medium). [1]

Exploitation

To exploit this vulnerability, an attacker needs to craft a request that includes directory traversal sequences (e.g., ../) in parameters processed by the plugin. The attack does not require authentication, making it accessible to unauthenticated users. Successful exploitation allows the attacker to include arbitrary local PHP files from the server, potentially exposing sensitive information. [1]

Impact

By reading local files, an attacker can disclose sensitive data such as database credentials stored in wp-config.php. If credentials are obtained, it could lead to complete database takeover, compromising the entire WordPress site. The vulnerability is noted as being used in mass-exploit campaigns, targeting thousands of websites regardless of size or popularity. [1]

Mitigation

The vulnerability is patched in version 2.4 of the plugin. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins. For those unable to update, consulting a hosting provider or web developer is recommended. The vulnerability is not listed as exploited in the wild (no KEV mention), but proactive patching is crucial. [1]