Privilege Escalation Vulnerability in Elementor Page Builder

CVE-2021-4447

Summary

The Essential Addons for Elementor plugin for WordPress contains a vulnerability that allows privilege escalation due to insufficient restrictions on adding custom registration forms and roles. Versions up to and including 4.6.4 are affected, enabling attackers with access to the Elementor page builder to create a new registration form. This form can be manipulated to set the default user role to administrator, allowing unauthorized users to register with elevated privileges, thereby compromising the site's security. It is critical for users of the affected versions to apply patches and updates promptly to mitigate potential risks.

References