CVE-2024-3018 – This vulnerability in the Essential Addons for ... (How to Fix)

Q: What is the severity of CVE-2024-3018?

CVE-2024-3018 has a CVSS score of 8.8 (HIGH). This vulnerability in the Essential Addons for Elementor WordPress plugin allows authenticated attackers with author-level access or higher to perform PHP object injection via the 'error_resetpassword' attribute. If a POP chain exists from other plugins/themes, attackers could delete files, steal data, or execute code. WordPress sites using vulnerable plugin versions are affected.

📋 TL;DR

This vulnerability in the Essential Addons for Elementor WordPress plugin allows authenticated attackers with author-level access or higher to perform PHP object injection via the 'error_resetpassword' attribute. If a POP chain exists from other plugins/themes, attackers could delete files, steal data, or execute code. WordPress sites using vulnerable plugin versions are affected.

💻 Affected Systems

Products:

Essential Addons for Elementor (WordPress plugin)

Versions: All versions up to and including 5.9.13

Operating Systems: All

Default Config Vulnerable: ✅ No

Notes: Requires the 'Login | Register Form' widget to be used (disabled by default) and author-level authenticated access.

📦 What is this software?

Essential Addons For Elementor by Wpdeveloper

View all CVEs affecting Essential Addons For Elementor →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete site compromise, data theft, and server takeover if a suitable POP chain exists.

🟠

Likely Case

Arbitrary file deletion or sensitive data exposure through available POP chains in common WordPress environments.

🟢

If Mitigated

Limited impact if no suitable POP chain exists, though object injection still poses risk.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires authenticated access and depends on available POP chains from other plugins/themes for full impact.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5.9.14

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3060417/essential-addons-for-elementor-lite

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Essential Addons for Elementor'. 4. Click 'Update Now' if available. 5. Alternatively, download version 5.9.14+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable widget

all

Remove or disable the 'Login | Register Form' widget from all pages/posts

Restrict user roles

all

Limit author-level and higher permissions to trusted users only

🧯 If You Can't Patch

Remove the Essential Addons for Elementor plugin entirely
Implement strict access controls and monitor for suspicious author-level user activity

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Essential Addons for Elementor → Version. If version is 5.9.13 or lower, you are vulnerable.

Check Version:

wp plugin list --name='essential-addons-for-elementor' --field=version

Verify Fix Applied:

Confirm plugin version is 5.9.14 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to wp-admin/admin-ajax.php with 'error_resetpassword' parameter
Unexpected file deletion or modification by author-level users

Network Indicators:

HTTP requests containing serialized PHP objects in parameters

SIEM Query:

source="wordpress.logs" AND ("error_resetpassword" OR "admin-ajax.php") AND status=200

📊 Metadata

CVE ID: CVE-2024-3018

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: March 30, 2024

Last Updated: January 8, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3018, you might also want to check these: