Lucene search

[email protected]NVD:CVE-2020-26596

HistoryOct 07, 2020 - 4:15 p.m.

CVE-2020-26596

2020-10-0716:15:17

CWE-269

[email protected]

web.nvd.nist.gov

dynamic ooo widget

elementor pro

remote authenticated

arbitrary code

editor role

php raw snippet

vulnerability

wordpress

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

72.9%

JSON

The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.

Affected configurations

Nvd

Node

wordpresswordpressRange≤5.5.1

AND

elementorelementor_proRange≤3.0.5wordpress

VendorProductVersionCPE
wordpresswordpress*cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
elementorelementor_pro*cpe:2.3:a:elementor:elementor_pro:*:*:*:*:*:wordpress:*:*