What’s Vulnerable › Vulnerabilities

CVE-2021-24175: The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-05 · updated 2026-06-17
• Weakness: CWE-287

Description

The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.

Affected products

• posimyththemes The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce: before 4.1.7 — fixed in 4.1.7

How to fix

Upgrade to a fixed version: posimyththemes The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce 4.1.7. Check the vendor advisory for mitigations.

References

• https://posimyth.ticksy.com/ticket/2713734/
• https://wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89
• https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/
• https://posimyth.ticksy.com/ticket/2713734/
• https://wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89
• https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/

Get alerted when CVE-2021-24175 or the next vulnerability affects your stack