CVE-2023-3779: Infoleak
First published: Thu Jul 20 2023(Updated: )
The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vulnerable version of this plugin with the MailChimp block enabled as the API key may have been compromised. This only affects sites running the premium version of the plugin and that have the Mailchimp block enabled on a page.
Credit: security@wordfence.com security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wpdeveloper Essential Addons For Elementor | <=5.8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2938177%40essential-addons-for-elementor-lite&new=2938177%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e007c713-74bc-4ff5-a198-70dcc8a8ee68?source=cve
Frequently Asked Questions
What is CVE-2023-3779?
CVE-2023-3779 is a vulnerability in the Essential Addons For Elementor plugin for WordPress that allows unauthenticated attackers to disclose the API key.
What is the severity of CVE-2023-3779?
CVE-2023-3779 has a severity of medium with a severity value of 5.3.
How does CVE-2023-3779 affect the Essential Addons For Elementor plugin?
CVE-2023-3779 affects versions up to and including 5.8.1 of the Essential Addons For Elementor plugin for WordPress.
How can unauthenticated attackers exploit CVE-2023-3779?
Unauthenticated attackers can exploit CVE-2023-3779 by accessing the source code of any page running the MailChimp block, which contains the API key.
How do I fix CVE-2023-3779?
To fix CVE-2023-3779, update the Essential Addons For Elementor plugin to a version higher than 5.8.1.
- collector/nvd-api
- collector/nvd-latest
- collector/nvd-index
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/wpdeveloper
- canonical/wpdeveloper essential addons for elementor
- version/wpdeveloper essential addons for elementor/5.8.1