CVE-2023-3295: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes it possible for authenticated attackers, with contributor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The issue was partially patched in version 1.5.66 and fully patched in 1.5.67
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPressto a version that resolves this vulnerability.Fixed in 1.5.67 - Operational
After upgrading to 1.5.67, review the WordPress uploads and the plugin’s file manager uploads for any unexpected or recently uploaded files, and remove any malicious artifacts.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3295?
The severity of CVE-2023-3295 is considered high due to potential arbitrary file upload vulnerabilities.
How do I fix CVE-2023-3295?
To fix CVE-2023-3295, update the Unlimited Elements for Elementor plugin to version 1.5.67 or later.
Which versions are affected by CVE-2023-3295?
CVE-2023-3295 affects Unlimited Elements for Elementor versions up to and including 1.5.66.
Can CVE-2023-3295 be exploited by unauthenticated users?
No, exploitation of CVE-2023-3295 requires authentication as a user.
What are the consequences of CVE-2023-3295 if exploited?
Exploitation of CVE-2023-3295 could allow attackers to upload malicious files, potentially leading to further attacks on the affected site.