Critical severity · published Feb 1, 2022
CVE-2022-0320
The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow…
9.8
CVSS
2%
EPSS
No
On KEV
Description
The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Essential Addons For Elementor · Wpdeveloper
before 5.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-0320
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-0320
Third Party Advisory
https://wpscan.com/vulnerability/0d02b222-e672-4ac0-a1d4-d34e1ecf4a95
More from Essential Addons For Elementor
9.8
CVE-2023-32243
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
8.8
CVE-2021-4447
Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation
8.8
CVE-2023-41955
WordPress Essential Addons for Elementor plugin <= 5.8.8 - Contributor+ Privilege Escalation vulnerability
8.8
CVE-2024-3018
Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword
8.8
CVE-2023-32245
WordPress Essential Addons for Elementor Pro Plugin <= 5.4.8 is vulnerable to Server Side Request Forgery (SSRF)