CVE-2021-24949
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the 'WP Search Filters' widget in The Plus Addons for Elementor Pro WordPress plugin. It affects WordPress sites using vulnerable plugin versions, potentially leading to data theft, modification, or complete site compromise. The SQL injection occurs due to unsanitized user input in the option parameter.
💻 Affected Systems
- The Plus Addons for Elementor - Pro WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data exfiltration, privilege escalation, remote code execution via database functions, and full site takeover.
Likely Case
Data extraction from WordPress database including user credentials, sensitive content, and plugin data, potentially leading to admin access.
If Mitigated
Limited impact with proper input validation and database user restrictions, possibly only data viewing without modification privileges.
🎯 Exploit Status
SQL injection via unsanitized GET/POST parameters. Public proof-of-concept available through WPScan and security researchers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.7 and later
Vendor Advisory: https://roadmap.theplusaddons.com/updates
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'The Plus Addons for Elementor - Pro'. 4. Click 'Update Now' if available, or download version 5.0.7+ from vendor. 5. Activate updated plugin.
🔧 Temporary Workarounds
Disable WP Search Filters Widget
allTemporarily disable the vulnerable widget until patching is possible
Navigate to Elementor > Settings > Advanced > Disable WP Search Filters widget
Web Application Firewall Rules
allBlock SQL injection patterns targeting the option parameter
Configure WAF to block requests containing SQL keywords in option parameter: SELECT, UNION, INSERT, UPDATE, DELETE, DROP, etc.
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application level
- Restrict database user permissions to SELECT only for frontend operations
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is below 5.0.7, site is vulnerable.Check Version:
wp plugin list --name='The Plus Addons for Elementor - Pro' --field=versionVerify Fix Applied:
Confirm plugin version is 5.0.7 or higher. Test WP Search Filters widget functionality remains working without SQL errors.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries in WordPress debug logs
- SQL syntax errors in web server logs
- Multiple requests with SQL keywords in option parameter
Network Indicators:
- HTTP requests containing SQL injection payloads in GET/POST parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND ("option=" AND ("SELECT" OR "UNION" OR "INSERT" OR "UPDATE" OR "DELETE"))