CVE-2024-0445 – This vulnerability allows authenticated WordPre... (How to Fix)

Q: What is the severity of CVE-2024-0445?

CVE-2024-0445 has a CVSS score of 6.4 (MEDIUM). This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into pages using The Plus Addons for Elementor plugin. The scripts are stored and execute whenever other users view the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using vulnerable plugin versions are affected.

📋 TL;DR

This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into pages using The Plus Addons for Elementor plugin. The scripts are stored and execute whenever other users view the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using vulnerable plugin versions are affected.

💻 Affected Systems

Products:

The Plus Addons for Elementor WordPress plugin

Versions: All versions up to and including 5.4.2

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with Elementor page builder and the vulnerable plugin installed. Contributor-level access or higher is needed for exploitation.

📦 What is this software?

The Plus Addons For Elementor by Posimyth

View all CVEs affecting The Plus Addons For Elementor →

The Plus Addons For Elementor by Posimyth

View all CVEs affecting The Plus Addons For Elementor →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or perform actions on behalf of authenticated users, potentially leading to complete site compromise.

🟠

Likely Case

Attackers with contributor access inject malicious scripts to steal user session cookies or credentials, leading to account takeover and limited site manipulation.

🟢

If Mitigated

With proper user role management and input validation, impact is limited to low-privileged user data exposure if exploitation occurs.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once attacker has contributor privileges. The vulnerability is in multiple widget files as shown in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5.5.0 and later

Vendor Advisory: https://wordpress.org/plugins/the-plus-addons-for-elementor/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'The Plus Addons for Elementor'. 4. Click 'Update Now' if available. 5. Alternatively, download version 5.5.0+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Restrict User Roles

all

Limit contributor and author roles to trusted users only, reducing attack surface.

Content Security Policy

linux

Implement CSP headers to restrict script execution sources.

Add to .htaccess: Header set Content-Security-Policy "script-src 'self'"
Add to nginx config: add_header Content-Security-Policy "script-src 'self'";

🧯 If You Can't Patch

Remove or disable The Plus Addons for Elementor plugin entirely
Implement strict user role management and audit all contributor-level accounts

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin → Plugins → Installed Plugins. If version is 5.4.2 or lower, you are vulnerable.

Check Version:

wp plugin list --name='the-plus-addons-for-elementor' --field=version

Verify Fix Applied:

After updating, verify plugin version shows 5.5.0 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to wp-admin/admin-ajax.php with plugin-specific parameters
Multiple page edits by contributor-level users in short timeframes

Network Indicators:

Unexpected script tags in page responses containing 'theplus-' or plugin-related attributes

SIEM Query:

source="wordpress.log" AND ("tp_flip_box" OR "tp_info_box" OR "tp_pricing_table") AND "admin-ajax.php"

📊 Metadata

CVE ID: CVE-2024-0445

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: May 14, 2024

Last Updated: January 27, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-0445, you might also want to check these: