Lucene search
Sanjay DasWPVDB-ID:471F3226-8F90-43D1-B826-F11EF4BBD602HistoryMay 02, 2023 - 12:00 a.m.
AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure
2023-05-0200:00:00
Sanjay Das
wpscan.com
4
plugin
secret key
unauthorized purchase
security
poc
disclosure
0.001 Low
EPSS
Percentile
25.0%
The plugin discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked.
PoC
See the disclosed secret key in includes/pro.php.
| CPE | Name | Operator | Version |
|---|---|---|---|
| anywhere-elementor | lt | 1.2.8 |
Related
cvelist
cvelist
CVE-2023-0443 AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure
2023-05-30 07:49:18
nvd
nvd
CVE-2023-0443
2023-05-30 08:15:09
cve
cve
CVE-2023-0443
2023-05-30 08:15:09
prion
prion
Design/Logic Flaw
2023-05-30 08:15:00
wpexploit
wpexploit
AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure
2023-05-02 00:00:00
wordfence
wordfence