CVE-2021-4447: Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation
The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create a new registration form that defaults to the user role being set to administrator and subsequently register as an administrative user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4447?
CVE-2021-4447 has been classified as a high severity vulnerability.
What versions of the Essential Addons for Elementor are affected by CVE-2021-4447?
CVE-2021-4447 affects versions up to and including 4.6.4 of the Essential Addons for Elementor plugin.
How do I fix CVE-2021-4447?
To fix CVE-2021-4447, you should update the Essential Addons for Elementor plugin to version 4.6.5 or higher.
What type of vulnerability is CVE-2021-4447?
CVE-2021-4447 is a privilege escalation vulnerability.
What impact does CVE-2021-4447 have on users?
CVE-2021-4447 allows unauthorized users to add registration forms and custom roles on Elementor created pages.