CVE-2024-13808: Xpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code Execution
First published: Sat Apr 26 2025(Updated: )
The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widget. This is due to their only being client side controls when determining who can access the widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xpro Elementor Addons - Pro | <=1.4.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-13808?
CVE-2024-13808 is classified as a critical vulnerability due to its potential for Remote Code Execution.
Who is affected by CVE-2024-13808?
CVE-2024-13808 affects all versions of the Xpro Elementor Addons - Pro plugin for WordPress up to and including version 1.4.9.
How do I fix CVE-2024-13808?
To fix CVE-2024-13808, users should update the Xpro Elementor Addons - Pro plugin to the latest version immediately.
What is the impact of CVE-2024-13808?
CVE-2024-13808 allows an attacker to execute arbitrary code on the affected server through the custom PHP widget.
What type of vulnerability is CVE-2024-13808?
CVE-2024-13808 is a Remote Code Execution vulnerability that compromises the security of WordPress sites using the affected plugin.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/title
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/source
- agent/severity
- agent/tags
- agent/event
- vendor/xpro
- canonical/xpro elementor addons - pro