CVE-2022-0320
📋 TL;DR
This vulnerability in the Essential Addons for Elementor WordPress plugin allows unauthenticated attackers to perform Local File Inclusion attacks, reading arbitrary files on the server. It can lead to Remote Code Execution through uploaded files or other LFI-to-RCE techniques. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Essential Addons for Elementor WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through Remote Code Execution, allowing attackers to execute arbitrary commands, steal sensitive data, install malware, or pivot to other systems.
Likely Case
Unauthorized file access leading to credential theft, configuration file exposure, and potential RCE if user upload functionality exists.
If Mitigated
Limited file access restricted by server permissions, but still exposes sensitive information like configuration files.
🎯 Exploit Status
Simple LFI exploitation with public proof-of-concept available. RCE requires additional steps but is documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.5 and later
Vendor Advisory: https://wordpress.org/plugins/essential-addons-for-elementor-lite/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find Essential Addons for Elementor. 4. Click 'Update Now' if available. 5. If manual update needed, download version 5.0.5+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched
wp plugin deactivate essential-addons-for-elementor-lite
Web Application Firewall Rule
allBlock LFI patterns in requests
Add WAF rule: Block requests containing '../' or similar path traversal patterns
🧯 If You Can't Patch
- Remove the Essential Addons plugin completely and use alternative Elementor addons
- Implement strict file permission controls and disable PHP execution in upload directories
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Essential Addons for Elementor → Version number. If version is below 5.0.5, you are vulnerable.Check Version:
wp plugin get essential-addons-for-elementor-lite --field=versionVerify Fix Applied:
Confirm plugin version is 5.0.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Requests containing '../' or similar path traversal sequences
- Access to sensitive files like wp-config.php
Network Indicators:
- HTTP requests with suspicious file paths in parameters
- Multiple failed LFI attempts
SIEM Query:
source="web_server_logs" AND (uri="*../*" OR uri="*wp-config*" OR uri="*etc/passwd*")