CVE-2022-1329-WordPress-Elementor-RCE

CVE-2022-1329-WordPress-Elementor-RCE 该POC主要是基于AkuCyberSec的研究版本，并进行了一些补充。 使用说明 使用docker-compose开启漏洞环境： docker-compose up -d 然后可以在浏览器访问WordPress的管理页面http://localhost:8000/wp-admin，创建admin用户，然后在User 标签下创建一个其他用户，举个例子如下： 用户名| 密码| 角色 ---|---|--- wc| 123456| Admin a2| aaaaaa| Editor 使用admin帐号登录，在插件...

CVE-2022-1329

CVE-2022-1329 🦠 Project developed by Agustín Sánchez Martín and Enrique Sánchez-Migallón Ochoa for the subject of Security in Computer Systems taught by Sebastián Reyes Ávila at the Higher School of Computer Science of Ciudad Real. This project contains the documentation and steps necessary to...

Exploit for Unrestricted Upload of File with Dangerous Type in Elementor Website_Builder

CVE-2022-1329 🦠 Proyecto desarrollado por Agustín Sánchez M...

CVE-2022-1329

The Elementor Website Builder plugin for WordPress (versions 3.6.0 to 3.6.2 ) is vulnerable to Remote Code Execution (RCE) due to a missing capability check in the ~/core/app/modules/onboarding/module.php file. An authenticated attacker can exploit this by calling the /wp-admin/admin-ajax.php end...

CVE-2022-1329 Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files...

CVE-2022-1329

creationtimestamp| type| source ---|---|--- 2022-04-17 06:23:53+00:00| published-proof-of-concept| https://t.me/proxybar/803 2022-04-17 22:20:29+00:00| published-proof-of-concept| https://t.me/MrVGunz/120 2022-04-18 04:21:33+00:00| published-proof-of-concept| https://t.me/LearnExploit/3397...

Exploit for Unrestricted Upload of File with Dangerous Type in Elementor Website_Builder

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Exe...

WordPress Elementor 3.6.2 Remote Code Execution Vulnerability

Description: Insufficient Access Control leading to Subscriber+ Remote Code Execution Affected Plugin: Elementor Plugin Slug: elementor Plugin Developer: Elementor Affected Versions: 3.6.0 – 3.6.2 CVE ID: CVE-2022-1329 CVSS Score: 9.9Critical CVSS Vector:...

Wordpress Plugin Elementor Authenticated Upload Remote Code Execution

The WordPress plugin Elementor versions 3.6.0 - 3.6.2, inclusive have a vulnerability that allows any authenticated user to upload and execute any PHP file. This is achieved by sending a request to install Elementor Pro from a user supplied zip file. Any user with Subscriber or more permissions i...