CVE-2024-11104: Sky Addons For Elementor DoS Vulnerability

CVE-2024-11104 Overview

CVE-2024-11104 affects the Sky Addons for Elementor plugin for WordPress, developed by wowdevs. The vulnerability stems from a missing capability check on the save_options() function in all versions up to and including 2.6.2. Authenticated attackers with subscriber-level access can update arbitrary WordPress options, limited to option values that can be saved as arrays. This unauthorized modification of data can lead to denial of service on affected sites. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact
Any authenticated subscriber can modify arbitrary array-based WordPress options, resulting in site integrity compromise and denial of service.

Affected Products

Sky Addons for Elementor (free WordPress plugin) versions up to and including 2.6.2
Vendor: wowdevs
Deployment target: WordPress sites using the free Sky Elementor Addons distribution

Discovery Timeline

2024-11-22 - CVE-2024-11104 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11104

Vulnerability Analysis

The Sky Addons for Elementor plugin exposes a save_options() handler that is intended to persist plugin configuration through the WordPress options API. The handler reaches update_option() without validating that the requesting user holds a privileged capability such as manage_options. WordPress requires authenticated AJAX endpoints to enforce their own capability checks, and this handler omits that step.

Because the endpoint is registered without capability validation, any authenticated user, including subscribers, can invoke it. The impact is bounded by the plugin's serialization logic, which only accepts option values that can be stored as arrays. Attackers can still overwrite security-sensitive array options used by WordPress core and third-party plugins, breaking site functionality and enabling denial of service.

Root Cause

The root cause is an authorization gap in save_options() located in includes/admin.php of the plugin. The function processes incoming option name and value parameters and writes them to the WordPress options table without calling current_user_can() prior to persistence. This omission falls under CWE-862 (Missing Authorization). Fix commits in the WordPress plugin repository add the missing capability check.

Attack Vector

Exploitation is network-based and requires only subscriber-level authentication, which is trivial to obtain on WordPress sites that allow open registration. The attacker sends a crafted request to the plugin's admin AJAX action, supplying an option name and an array value. The plugin writes the supplied value into wp_options, replacing legitimate configuration. No user interaction from an administrator is required.

Because realCodeExamples are not available for this CVE, refer to the affected source in the WordPress plugin repository at admin.php line 1267 and the handler at line 1290 for the vulnerable implementation.

Detection Methods for CVE-2024-11104

Indicators of Compromise

Unexpected modifications to entries in the wp_options table, particularly options that store arrays used by security, caching, or membership plugins.
POST requests from low-privilege authenticated sessions to wp-admin/admin-ajax.php invoking the Sky Elementor Addons save_options action.
Sudden site behavior changes such as broken layouts, disabled features, or authentication issues following plugin activity by non-admin users.

Detection Strategies

Enable WordPress audit logging to record option updates with the acting user and originating IP address.
Alert on any update_option events triggered by users whose role is subscriber, contributor, or author.
Baseline the set of options touched by Sky Addons for Elementor during normal admin use and flag deviations.

Monitoring Recommendations

Forward web server access logs and WordPress application logs to a centralized analytics platform for correlation.
Monitor for repeated POST requests to admin-ajax.php with the plugin's action parameter from newly registered accounts.
Track version inventory of the Sky Addons for Elementor plugin across managed WordPress instances to identify unpatched hosts.

How to Mitigate CVE-2024-11104

Immediate Actions Required

Update the Sky Addons for Elementor plugin to a version later than 2.6.2 that includes the capability check fix.
Audit all user accounts and remove or downgrade unused subscriber-level accounts that could be leveraged by an attacker.
Review the wp_options table for recent unauthorized modifications and restore known-good values from backups where required.

Patch Information

The vendor addressed the issue in changesets published to the WordPress plugin repository. See the WordPress changeset 3189030 and the follow-up WordPress changeset 3193495. Additional analysis is available in the Wordfence vulnerability report.

Workarounds

Disable open user registration or restrict new accounts to a role that cannot authenticate to admin AJAX endpoints until the plugin is patched.
Deploy a web application firewall rule that blocks unauthenticated and low-privilege POST requests to the plugin's save_options action.
Temporarily deactivate the Sky Addons for Elementor plugin on sites where patching cannot be completed immediately.

bash

# Example WordPress CLI commands to reduce exposure
wp plugin update sky-elementor-addons
wp option get users_can_register
wp option update users_can_register 0
wp user list --role=subscriber --fields=ID,user_login,user_registered