CVE-2024-3018: Essential Addons for Elementor RCE Flaw

CVE-2024-3018 Overview

CVE-2024-3018 is a PHP Object Injection vulnerability in the Essential Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 5.9.13. It stems from unsafe deserialization of untrusted input in the error_resetpassword attribute of the "Login | Register Form" widget, which is disabled by default. Authenticated attackers with author-level access or above can inject arbitrary PHP objects. When a Property-Oriented Programming (POP) chain exists in another installed plugin or theme, attackers can delete arbitrary files, retrieve sensitive data, or execute code on the target system. The vulnerability is tracked under [CWE-502] Deserialization of Untrusted Data.

Critical Impact
Authenticated author-level attackers can achieve remote code execution, file deletion, or data exfiltration when a POP chain is present in any other installed plugin or theme.

Affected Products

WPDeveloper Essential Addons for Elementor (Lite) — all versions up to and including 5.9.13
WordPress sites using the plugin's "Login | Register Form" widget with the reset password error attribute enabled
Sites running additional plugins or themes that expose a usable POP chain

Discovery Timeline

2024-03-30 - CVE-2024-3018 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3018

Vulnerability Analysis

The vulnerability resides in the plugin's "Login | Register Form" widget. The widget accepts a user-controlled error_resetpassword attribute and passes its contents to a PHP deserialization routine without validating that the data is a trusted serialized string. When PHP processes the serialized payload, it reconstructs objects and invokes their magic methods such as __wakeup or __destruct.

By itself, object instantiation does not guarantee code execution. Exploitation requires a POP chain, a sequence of classes with side-effect-producing magic methods reachable from the loaded WordPress environment. Because WordPress installations typically load many plugins and themes, POP gadgets are often available in practice. Attackers chain these gadgets to reach sinks such as file_put_contents, unlink, or call_user_func.

Root Cause

The root cause is direct use of unserialize() (or equivalent) on attacker-supplied input in the widget's error handling logic. The plugin does not enforce an allowed_classes restriction, does not validate signatures on the serialized data, and does not restrict the widget's attribute to a safe primitive type.

Attack Vector

The attack is remote and requires authentication at the author role or higher. An authenticated attacker crafts a serialized PHP object payload, then injects it through the vulnerable widget attribute in a post or page they can edit. When the widget renders, the plugin deserializes the payload and instantiates the attacker-controlled object graph. If a matching POP chain is present in the environment, the reconstructed objects trigger file operations, database queries, or command execution during the WordPress request lifecycle.

The vulnerability is described in prose because no verified public exploit code has been released. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-3018

Indicators of Compromise

Post or page content containing serialized PHP object markers such as O: or a: inside the error_resetpassword attribute of Elementor widget data
Unexpected file creation, modification, or deletion in wp-content/uploads, wp-content/plugins, or theme directories following author-role activity
New or modified administrator accounts created after suspicious post edits
Outbound network connections from the PHP-FPM or web server process to unknown hosts

Detection Strategies

Inspect Elementor post meta (_elementor_data) for serialized object signatures within error_resetpassword fields.
Review WordPress audit logs for author-level users editing pages that contain the Login | Register Form widget.
Deploy a Web Application Firewall (WAF) rule that blocks requests containing serialized PHP object patterns in Elementor widget parameters.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress webroot to detect unauthorized writes or deletions triggered by POP chain execution.
Forward PHP error logs and web server access logs to a centralized analytics platform and alert on deserialization errors or class-not-found exceptions.
Monitor for privilege changes in the wp_users and wp_usermeta tables that follow post edits by author-level accounts.

How to Mitigate CVE-2024-3018

Immediate Actions Required

Update Essential Addons for Elementor to version 5.9.14 or later on all WordPress sites.
Audit author-role and higher accounts, remove unused accounts, and rotate credentials for accounts that remain active.
Review recent posts and pages that use the Login | Register Form widget for suspicious serialized content in the reset password attributes.

Patch Information

The vendor released a fix in the plugin changeset published at WordPress Plugin Change Notice. The patch corresponds to Essential Addons for Elementor version 5.9.14. Site operators should apply the update through the WordPress admin dashboard or via wp-cli using wp plugin update essential-addons-for-elementor-lite.

Workarounds

Disable the Login | Register Form widget in the plugin's element settings if the update cannot be applied immediately.
Restrict author-role assignment to trusted users only and require multi-factor authentication for all contributor and above accounts.
Deploy a WAF signature that inspects Elementor widget payloads for serialized PHP object patterns and blocks them.

bash

# Update the plugin using WP-CLI
wp plugin update essential-addons-for-elementor-lite

# Verify the installed version is 5.9.14 or later
wp plugin get essential-addons-for-elementor-lite --field=version