CVE-2024-4378 – This vulnerability allows authenticated attacke... (How to Fix)

Q: What is the severity of CVE-2024-4378?

CVE-2024-4378 has a CVSS score of 6.4 (MEDIUM). This vulnerability allows authenticated attackers with contributor-level access or higher to inject malicious scripts into WordPress pages using the Premium Addons for Elementor plugin. The scripts execute when users visit the compromised pages, enabling session hijacking, credential theft, or content manipulation. All WordPress sites using vulnerable versions of this plugin are affected.

📋 TL;DR

This vulnerability allows authenticated attackers with contributor-level access or higher to inject malicious scripts into WordPress pages using the Premium Addons for Elementor plugin. The scripts execute when users visit the compromised pages, enabling session hijacking, credential theft, or content manipulation. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

Premium Addons for Elementor WordPress plugin

Versions: All versions up to and including 4.10.30

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires contributor-level or higher authenticated access. Elementor plugin must be installed and active.

📦 What is this software?

Premium Addons For Elementor by Leap13

View all CVEs affecting Premium Addons For Elementor →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, take over the WordPress site, deface pages, redirect users to malicious sites, or install backdoors for persistent access.

🟠

Likely Case

Attackers inject malicious scripts to steal user session cookies, redirect visitors to phishing pages, or display unwanted advertisements.

🟢

If Mitigated

With proper user role management and content review processes, impact is limited to potential defacement of non-critical pages.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once attacker has contributor privileges. Multiple public references demonstrate the vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.10.31 and later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3090037

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Premium Addons for Elementor'. 4. Click 'Update Now' if available. 5. Alternatively, download version 4.10.31+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Temporary plugin deactivation

all

Disable the vulnerable plugin until patched

wp plugin deactivate premium-addons-for-elementor

Restrict user roles

all

Temporarily remove contributor-level access for untrusted users

🧯 If You Can't Patch

Implement strict content review process for all contributor submissions
Install a web application firewall (WAF) with XSS protection rules

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 4.10.30 or lower, you are vulnerable.

Check Version:

wp plugin get premium-addons-for-elementor --field=version

Verify Fix Applied:

After updating, verify plugin version shows 4.10.31 or higher in WordPress admin.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to menu or shape widget endpoints
Multiple failed login attempts followed by successful contributor login
Suspicious script tags in page content

Network Indicators:

Outbound connections to unknown domains from your WordPress site
Unexpected script loads in page responses

SIEM Query:

source="wordpress" AND (uri_path="/wp-admin/admin-ajax.php" AND parameters CONTAINS "pa_nav_menu" OR "premium_shape")

📊 Metadata

CVE ID: CVE-2024-4378

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: May 23, 2024

Last Updated: January 8, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4378, you might also want to check these: