CVE-2024-8978
📋 TL;DR
This vulnerability in the Essential Addons for Elementor WordPress plugin allows authenticated attackers with Contributor-level access or higher to extract usernames and passwords of users who register via the Login/Register Form widget. The exposure occurs when the registered user opens their registration confirmation email. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Essential Addons for Elementor WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative credentials, leading to complete site compromise, data theft, malware injection, or site defacement.
Likely Case
Attackers harvest user credentials for credential stuffing attacks, account takeover, or lateral movement within the organization.
If Mitigated
With proper access controls and monitoring, impact is limited to potential exposure of some user credentials requiring password resets.
🎯 Exploit Status
Requires Contributor-level WordPress access. Exploitation is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.1.0
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3188634/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Essential Addons for Elementor'. 4. Click 'Update Now' if available. 5. If not, download version 6.1.0+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable Login/Register Widget
allTemporarily remove or disable the vulnerable Login | Register Form widget from your site.
Restrict User Registration
allDisable user registration functionality until patched.
🧯 If You Can't Patch
- Implement strict access controls to limit Contributor-level users
- Monitor user registration logs and email notification activities
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is 6.0.9 or lower, you are vulnerable.Check Version:
wp plugin list --name='essential-addons-for-elementor-lite' --field=versionVerify Fix Applied:
Confirm plugin version is 6.1.0 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual access to user registration data by Contributor-level users
- Multiple user registration attempts from single IP
Network Indicators:
- Unusual traffic patterns to registration endpoints
SIEM Query:
source="wordpress" AND (event="user_registration" OR plugin="essential-addons") AND user_role="contributor"