CVE-2024-4862 – This vulnerability allows authenticated WordPre... (How to Fix)

Q: What is the severity of CVE-2024-4862?

CVE-2024-4862 has a CVSS score of 6.4 (MEDIUM). This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into web pages using the WPBITS Addons For Elementor plugin. The scripts are stored and execute whenever users visit the compromised pages, enabling session hijacking, defacement, or malware distribution. All WordPress sites using vulnerable versions of this plugin are affected.

📋 TL;DR

This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into web pages using the WPBITS Addons For Elementor plugin. The scripts are stored and execute whenever users visit the compromised pages, enabling session hijacking, defacement, or malware distribution. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

WPBITS Addons For Elementor Page Builder

Versions: All versions up to and including 1.5

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with Elementor Page Builder and the vulnerable plugin installed. Contributor or higher user role needed for exploitation.

📦 What is this software?

Wpbits Addons For Elementor Page Builder by Wpbits

View all CVEs affecting Wpbits Addons For Elementor Page Builder →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain administrative access, steal sensitive data, install backdoors, or distribute malware to site visitors.

🟠

Likely Case

Site defacement, cookie/session theft, redirects to malicious sites, or credential harvesting from users.

🟢

If Mitigated

Limited to authenticated users only, with minimal impact if proper user role management and content review processes exist.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once attacker has contributor privileges. Multiple widget entry points increase attack surface.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version after 1.5

Vendor Advisory: https://wordpress.org/plugins/wpbits-addons-for-elementor/

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'WPBITS Addons For Elementor'
4. Click 'Update Now' if available
5. If no update available, deactivate and remove plugin
6. Check for updated version on WordPress plugin repository

🔧 Temporary Workarounds

Restrict User Roles

all

Temporarily limit contributor-level access or implement additional content approval workflows

Content Security Policy

linux

Implement CSP headers to restrict script execution sources

Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or add to WordPress functions.php: header("Content-Security-Policy: default-src 'self'; script-src 'self'");

🧯 If You Can't Patch

Deactivate and remove the WPBITS Addons For Elementor plugin immediately
Implement strict user role management and review all content from contributors

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'WPBITS Addons For Elementor' version 1.5 or lower

Check Version:

wp plugin list --name='wpbits-addons-for-elementor' --field=version

Verify Fix Applied:

Verify plugin version is higher than 1.5 or plugin is removed from installed plugins list

📡 Detection & Monitoring

Log Indicators:

Unusual content modifications by contributor users
Multiple page edits in short timeframes
Script tags in page content from non-admin users

Network Indicators:

External script loads from pages that shouldn't have them
Unusual redirect patterns

SIEM Query:

source="wordpress" AND (event="page_edit" AND user_role="contributor" AND content CONTAINS "<script>")

📊 Metadata

CVE ID: CVE-2024-4862

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: July 9, 2024

Last Updated: March 6, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4862, you might also want to check these: