CVE-2024-13808: Xpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code Execution
The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widget. This is due to their only being client side controls when determining who can access the widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13808?
CVE-2024-13808 is classified as a critical vulnerability due to its potential for Remote Code Execution.
Who is affected by CVE-2024-13808?
CVE-2024-13808 affects all versions of the Xpro Elementor Addons - Pro plugin for WordPress up to and including version 1.4.9.
How do I fix CVE-2024-13808?
To fix CVE-2024-13808, users should update the Xpro Elementor Addons - Pro plugin to the latest version immediately.
What is the impact of CVE-2024-13808?
CVE-2024-13808 allows an attacker to execute arbitrary code on the affected server through the custom PHP widget.
What type of vulnerability is CVE-2024-13808?
CVE-2024-13808 is a Remote Code Execution vulnerability that compromises the security of WordPress sites using the affected plugin.