Remote Code Execution Vulnerability in Borderless Plugin for WordPress

CVE-2024-11600

What is CVE-2024-11600?

The Borderless plugin for WordPress, specifically the Widgets, Elements, Templates, and Toolkit for Elementor & Gutenberg, is exposed to a Remote Code Execution vulnerability due to insufficient sanitization mechanisms in its 'write_config' function. This flaw allows authenticated users with Administrator privileges to import an unsanitized JSON file, enabling them to execute arbitrary code on the server. Users should ensure they update their plugins to mitigate potential exploitation risks and secure their sites.

References