CVE-2023-48777 Scanner

WordPress Elementor is a widely used drag-and-drop page builder plugin that enables website developers, designers, and content creators to construct visually appealing pages without writing code. It is employed by freelancers, agencies, and businesses to rapidly design responsive layouts for blogs, e-commerce stores, and corporate sites. Elementor's extensive widget library and template system simplify site customization, making it a staple in the WordPress ecosystem. Its popularity means that any security flaw can affect millions of sites, underscoring the need for regular vulnerability assessments.

CVE-2023-48777 is a critical Remote Code Execution (RCE) vulnerability that arises from improper validation of template imports within Elementor. The flaw allows an attacker to bypass security checks and upload arbitrary files, including PHP shells, to the server. This occurs because the plugin fails to adequately sanitize file types and contents during the import process, enabling malicious payloads to be executed. The vulnerability is rated CVSS 9.9 due to its low complexity and potential for full system compromise.

Technically, the vulnerability is triggered through the template import endpoint, specifically the `elementor-ajax` action handler. An unauthenticated attacker can craft a malicious request containing a base64-encoded PHP file disguised as a valid Elementor template. The plugin's import function does not verify the file's integrity or type, allowing the attacker to write the payload to the server's file system. Once written, the attacker can access the file directly via a web request, leading to remote code execution.

If exploited, an attacker can execute arbitrary commands on the web server, potentially gaining full control over the WordPress installation. This could lead to data theft, website defacement, malware distribution, or lateral movement within the network. Given Elementor's widespread use, the impact is severe, affecting millions of sites. Immediate remediation is critical to prevent unauthorized access and maintain site integrity.