Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2020-26596
HistoryOct 07, 2020 - 4:15 p.m.

CVE-2020-26596

2020-10-0716:15:17
CWE-269
mitre
web.nvd.nist.gov
400
cve-2020-26596
elementor pro
wordpress
security
remote code execution
cve

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.004

Percentile

72.9%

JSON

The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.

Affected configurations

Nvd
Node
wordpresswordpressRange≤5.5.1
AND
elementorelementor_proRange≤3.0.5wordpress
VendorProductVersionCPE
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
elementorelementor_pro*cpe:2.3:a:elementor:elementor_pro:*:*:*:*:*:wordpress:*:*

Related

nvd 1
prion 1
cvelist 1
osv 1
wpvulndb 1
patchstack 1
wpexploit 1
nvd
nvd
CVE-2020-26596
2020-10-07 16:15:17
prion
prion
Code injection
2020-10-07 16:15:00
cvelist
cvelist
CVE-2020-26596
2020-10-07 15:32:27
osv
osv
CVE-2020-26596
2020-10-07 16:15:17
wpvulndb
wpvulndb
Dynamic Content for Elementor < 1.9.6 - Authenticated RCE
2020-10-08 00:00:00
patchstack
patchstack
WordPress Dynamic Content for Elementor premium plugin <= 1.9.5.6 - Authenticated Remote Code Execution (RCE) vulnerability
2020-10-08 00:00:00
wpexploit
wpexploit
Dynamic Content for Elementor < 1.9.6 - Authenticated RCE
2020-10-08 00:00:00

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.004

Percentile

72.9%

JSON
Related for CVE-2020-26596
nvd1prion1cvelist1osv1wpvulndb1patchstack1wpexploit1