CVE Database /
CVE-2024-3018
CVE · High
CVE-2024-3018 — Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite] < 5.9.14
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-3018
|
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite] < 5.9.14 |
Deserialization of Untrusted Data |
High
8.8
|
< 5.9.14
|
5.9.14 |
2024-03-29 |
—
|
CVE-2024-3018
The Essential Addons for Elementor plugin contains a PHP Object Injection vulnerability in versions before 5.9.14 through unsafe deserialization of the 'error_resetpassword' attribute in the Login | Register Form widget, which is disabled by default. Authenticated users with author-level permissions or higher can inject malicious PHP objects that, when combined with a gadget chain from another installed plugin or theme, could lead to arbitrary file deletion, data theft, or code execution.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings