CVE-2023-3779: Essential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key Disclosure
The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vulnerable version of this plugin with the MailChimp block enabled as the API key may have been compromised. This only affects sites running the premium version of the plugin and that have the Mailchimp block enabled on a page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Reset any MailChimp API keys if running Essential Addons For Elementor version up to and including 5.8.1 with the MailChimp block enabled, because the API key may have been compromised.
Event History
Frequently Asked Questions
What is CVE-2023-3779?
CVE-2023-3779 is a vulnerability in the Essential Addons For Elementor plugin for WordPress that allows unauthenticated attackers to disclose the API key.
What is the severity of CVE-2023-3779?
CVE-2023-3779 has a severity of medium with a severity value of 5.3.
How does CVE-2023-3779 affect the Essential Addons For Elementor plugin?
CVE-2023-3779 affects versions up to and including 5.8.1 of the Essential Addons For Elementor plugin for WordPress.
How can unauthenticated attackers exploit CVE-2023-3779?
Unauthenticated attackers can exploit CVE-2023-3779 by accessing the source code of any page running the MailChimp block, which contains the API key.
How do I fix CVE-2023-3779?
To fix CVE-2023-3779, update the Essential Addons For Elementor plugin to a version higher than 5.8.1.