CVE-2024-11104 – This vulnerability in Sky Addons for Elementor ... (How to Fix)

Q: What is the severity of CVE-2024-11104?

CVE-2024-11104 has a CVSS score of 8.1 (HIGH). This vulnerability in Sky Addons for Elementor WordPress plugin allows authenticated attackers with subscriber-level access or higher to modify arbitrary WordPress site options that can be saved as arrays. This can lead to denial of service or other site disruptions. All WordPress sites using vulnerable versions of this plugin are affected.

📋 TL;DR

This vulnerability in Sky Addons for Elementor WordPress plugin allows authenticated attackers with subscriber-level access or higher to modify arbitrary WordPress site options that can be saved as arrays. This can lead to denial of service or other site disruptions. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

Sky Addons for Elementor WordPress plugin

Versions: All versions up to and including 2.6.2

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with the vulnerable plugin installed. Attackers need at least subscriber-level authenticated access.

📦 What is this software?

Sky Addons For Elementor by Wowdevs

View all CVEs affecting Sky Addons For Elementor →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete site takeover by modifying critical WordPress options like admin credentials, site URL, or disabling the site entirely through DoS.

🟠

Likely Case

Site disruption or defacement by modifying visible site settings, disabling features, or causing errors through option manipulation.

🟢

If Mitigated

Limited impact if proper access controls and monitoring are in place, with only minor configuration changes possible.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is technically simple once authenticated.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.6.3 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193495%40sky-elementor-addons&new=3193495%40sky-elementor-addons

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'Sky Addons for Elementor'. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.6.3+ from WordPress.org and manually update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the Sky Addons for Elementor plugin until patched

wp plugin deactivate sky-elementor-addons

Restrict user registration

all

Disable new user registration to prevent attacker account creation

In WordPress Settings → General, uncheck 'Anyone can register'

🧯 If You Can't Patch

Implement strict access controls and monitor user activity logs
Use web application firewall rules to block suspicious option modification requests

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin → Plugins → Sky Addons for Elementor. If version is 2.6.2 or lower, you are vulnerable.

Check Version:

wp plugin get sky-elementor-addons --field=version

Verify Fix Applied:

After updating, verify plugin version shows 2.6.3 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

POST requests to /wp-admin/admin-ajax.php with action=sky_elementor_addons_save_options from non-admin users
Unexpected modifications to wp_options table

Network Indicators:

HTTP POST requests containing 'sky_elementor_addons_save_options' action parameter

SIEM Query:

source="wordpress.log" AND "sky_elementor_addons_save_options" AND user_role!="administrator"

📊 Metadata

CVE ID: CVE-2024-11104

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE: CWE-862

Published: November 22, 2024

Last Updated: February 5, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-11104, you might also want to check these: