CVE-2024-13808 Overview
CVE-2024-13808 affects the Xpro Elementor Addons - Pro plugin for WordPress in all versions up to and including 1.4.9. The plugin exposes a custom PHP widget that relies solely on client-side controls to restrict access. Authenticated users with Contributor-level access or higher can bypass these client-side checks and execute arbitrary PHP code on the server. The flaw is classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Any authenticated user with Contributor privileges or above can achieve remote code execution on the underlying WordPress host, leading to full site compromise.
Affected Products
- Xpro Elementor Addons - Pro plugin for WordPress
- All versions up to and including 1.4.9
- Vendor: wpxpro
Discovery Timeline
- 2025-04-26 - CVE-2024-13808 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13808
Vulnerability Analysis
The vulnerability resides in the plugin's custom PHP widget, a feature designed to allow trusted administrators to embed PHP snippets inside Elementor-built pages. The plugin enforces access to this widget using client-side controls rather than server-side capability checks. Attackers can craft direct requests to the widget's server endpoint that bypass the front-end restrictions. Because the widget evaluates supplied PHP code during page rendering, arbitrary code executes in the WordPress process context. Successful exploitation typically results in webshell deployment, credential theft from wp-config.php, or lateral movement to other hosted sites.
Root Cause
The root cause is missing server-side authorization for a code-generation feature. The plugin trusts client-side role checks to gate access to PHP evaluation logic. WordPress users with the Contributor role should not have the unfiltered_html or edit_pages capabilities required to author executable content. The plugin, however, does not validate these capabilities server-side before processing widget input, satisfying the criteria of CWE-94.
Attack Vector
Exploitation requires network access to the WordPress site and valid Contributor-level credentials. The attacker authenticates, submits a page or post containing the malicious custom PHP widget with attacker-supplied code, and triggers rendering. The plugin passes the payload to a PHP evaluation routine, executing the code with the privileges of the web server user. No user interaction from an administrator is required. For technical details, see the Wordfence Vulnerability Report.
Detection Methods for CVE-2024-13808
Indicators of Compromise
- Unexpected PHP files written under wp-content/uploads/ or plugin directories following widget activity
- Outbound network connections from the PHP-FPM or Apache worker process to unfamiliar hosts
- New or modified WordPress users with elevated privileges created shortly after Contributor logins
- Requests to Elementor admin-ajax.php or REST endpoints containing PHP tokens such as <?php, system(, or base64_decode(
Detection Strategies
- Audit installed plugin versions and flag Xpro Elementor Addons - Pro at 1.4.9 or earlier
- Inspect post and revision content in wp_posts for serialized Elementor data containing custom PHP widget entries
- Correlate Contributor account activity with page-preview and page-render events that reference the PHP widget module
Monitoring Recommendations
- Enable WordPress audit logging for role changes, plugin edits, and post revisions authored by non-administrator accounts
- Monitor web server logs for POST requests to Elementor editor endpoints originating from Contributor-level sessions
- Alert on process execution from the web server user spawning shells (sh, bash) or network utilities (curl, wget)
How to Mitigate CVE-2024-13808
Immediate Actions Required
- Upgrade the Xpro Elementor Addons - Pro plugin to a version later than 1.4.9 as soon as the vendor releases a fix
- Review all WordPress accounts with Contributor privileges or higher and disable unused or suspicious users
- Rotate WordPress secrets in wp-config.php and administrator passwords if exploitation is suspected
- Scan the web root for unauthorized PHP files and remove any identified webshells
Patch Information
No fixed version is listed in the current NVD record. Administrators should consult the WPXPro Elementor resource and the Wordfence Vulnerability Report for updated release information and apply the patched version once available.
Workarounds
- Deactivate and remove the Xpro Elementor Addons - Pro plugin until a patched version is installed
- Restrict Contributor-level account creation and require administrator approval for role assignments
- Deploy a web application firewall rule blocking POST bodies to Elementor endpoints that contain PHP opening tags or dangerous function names
# Example WAF rule concept blocking PHP tokens in Elementor editor traffic
# (adapt to your WAF syntax)
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
"chain,phase:2,deny,status:403,id:2024013808,msg:'Blocked PHP token in Elementor editor request'"
SecRule REQUEST_BODY "@rx (?i)(<\?php|system\(|base64_decode\(|passthru\()" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
