In a nutshell:
- Essential Addons for Elementor is one of the most widely used plugin bundles for WordPress—and in 2024, it had a critical security vulnerability that affected millions of websites.
- Anyone who uses such plugins without monitoring is operating on blind trust.
- We’ll show you how to systematically keep track of WordPress plugin risks.
In today’s digital world, the security of our online presence plays a crucial role. Secure website operation is not only essential for building user trust but also for protecting sensitive data. Nevertheless, it can happen that security vulnerabilities are suddenly discovered even in proven systems and plugins. A recent example involves the popular WordPress plugin “Essential Addons for Elementor.”
The Situation: Millions of Websites Affected
The Essential Addons for Elementor plugin is used on over a million websites worldwide. A critical security vulnerability was recently discovered that has the potential to cause significant damage. The vulnerability allows potential attackers to take control of websites where the affected plugin is installed.
The discovery of the security vulnerability
The vulnerability was discovered and investigated by IT security researchers. They determined that attackers can use this vulnerability to elevate their privileges on the system without requiring prior authentication. This vulnerability affects plugin versions from 5.4.0 through 5.7.1. The security researchers classified the risk as critical, with a CVSS score of 9.8.[1][2]
The Impact of the Vulnerability
This critical vulnerability allows attackers to reset any user’s password as long as the user’s username is known. For example, they could reset the administrator’s password and log into that account. The researchers found that the password reset function does not validate an associated key and instead directly changes the affected user’s password.[3][4][5]
The Solution: Updating the Plugin
The developers of Essential Addons for Elementor responded immediately to the discovered vulnerability and released an updated plugin within three days. This update closes the critical security vulnerability and restores security to affected websites. It is strongly recommended that you install the update immediately.
The Need for Continuous Maintenance and Updates
This situation underscores the need for continuous maintenance and updating of websites and their components. A maintenance contract can ensure that your website is always up to date and protected against potential security risks. Our team at Waterproof Web Wizard GmbH would be happy to provide you with a customized quote.
Stay up to date
To stay informed about the latest developments, particularly in the areas of online marketing, SEO, TYPO3, and WordPress, we recommend subscribing to our newsletter. We regularly share updates, tips, and tricks to help you design and operate your website securely and efficiently.
Summary and Conclusion
In summary, the recently discovered security vulnerability in the widely used Essential Addons for Elementor plugin poses a significant risk to website operators. The vulnerability allows attackers to take control of the affected website by escalating their privileges in the system without prior authentication. Fortunately, the plugin’s developers responded promptly to the security report and released an update that patches the vulnerability. It is strongly recommended that you install this update as soon as possible to minimize the risk of an attack.
This situation underscores the importance of regular updates and maintenance for website security. By keeping your website up to date, you can minimize the risk of security vulnerabilities and related attacks.
In closing, we would like to remind you that website security is an ongoing process. It is important to stay up to date with security updates and regularly check your website for potential security risks. Also, take advantage of the resources available to you, including the expertise of IT security professionals and regular security newsletters. This way, you can ensure that your website remains safe and secure in the future.