Skip to:
Share this article:
One flaw found in WordPress plugins Ultimate Addons for Beaver Builder and Ultimate Addons for Elementor is actively being exploited.
UPDATE
Security researchers are warning users of two WordPress plugins – made by Brainstorm Force – that they need to patch a “major” vulnerability that could allow hackers to gain administrative access to any website using the plugins. According to Brainstorm Force, it is only aware of one customer who had its website compromised because of this bug. However, another source is also reported a successful attack since the bug was discovered on Wednesday.
The plugins in question are Ultimate Addons for Beaver Builder and Ultimate Addons for Elementor. Both WordPress plugins are designed to help website publishers easily add advanced designs and user functions to websites built using the specific frameworks Beaver Builder and Elementor.
“[This is] a major vulnerability that could allow hackers to gain admin access to any WordPress website that had the plugin installed. This means hackers can gain full control of your website if you are using the plugin,” wrote security firm MalCare, in a post published Thursday.
MalCare said it discovered the flaw, classified as an authentication bypass bug, on Wednesday and immediately alerted Brainstorm Force the same day. Developers at Brainstorm Force moved fast, releasing a fix for the bug effecting both plugins within seven hours. Patched versions include Ultimate Addons for Beaver Builder (version 1.2.4.1) and Ultimate Addons for Elementor (version 1.20.1).
A research team at web application security firm WebARX said it also began tracking the bug this week and claim hackers are actively exploiting the vulnerability.
“We’ve learned over the forensics that the attackers have been targeting websites with Ultimate Add-ons Elementor plugin since the 10th of December,” WebARX wrote in a company blog post.
WebARX claims that hackers are targeting vulnerable sites and, “uploading tmp.zip file to install fake SEO stats plugin which will then add a wp-xmlrpc.php backdoor to the root directory of the vulnerable website. After the infection, multiple IP’s try to access the wp-xmlrpc.php file.”
Brainstorm Force told Threatpost it doesn’t know for sure how many potential customers are impacted by this bug because the sites using the plugins are hosted on servers outside its purview. “As a hacker needs to know the email address of the [WordPress admin] user, the number of exploits might be low,” a company spokesperson told Threatpost.
Security team members explain the vulnerability is present when either the Elementor and Beaver Builder plugins are installed into the WordPress platform. To exploit the bug, all a hacker needs is the email address of an admin user of the site, MalCare explains. Next, so long as the affected plugin is in use, gaining administrator access to the website is as easy as logging into WordPress.
“The vulnerable version of the plugin has a feature that allows people to log in using a regular username/password combination, Facebook and Google, WebARX explained. “However, the Facebook and Google authentication methods did not verify the token returned by Facebook and Google, and since they don’t require a password, there was no password check.”
Brainstorm Force did make a public statement on the Elementor and Beaver Builder bugs. It also told Threatpost, “We’ve released an update and have patched the vulnerable code. Users can apply the patch by updating the plugin in one click. Users who have registered their licence key see an update notification in their WordPress dashboard. All they need to do is click update.”
(This article was updated at 6:15 ET 12/13/2019 with a response from Brainstorm Force.)
Free Threatpost Webinar: Risk around third-party vendors is real and can lead to data disasters. We rely on third-party vendors, but that doesn’t mean forfeiting security. Join us on Dec. 18^th at 2 pm EST as Threatpost looks at managing third-party relationship risks with industry experts Dr. Larry Ponemon, of Ponemon Institute; Harlan Carvey, with Digital Guardian and Flashpoint’s Lance James. Click here to register.
Share this article:
Two security vulnerabilities — one a privilege-escalation problem and the other a stored XSS bug — afflict a WordPress plugin with 40,000 installs.
A critical unrestricted file upload bug in Contact Form 7 allows an unauthenticated visitor to take over a site running the plugin.
A poorly configured file opens users up to site takeover.
The First Stop For Security News
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.

source