CVE-2024-35674 Overview
CVE-2024-35674 is a missing authorization vulnerability in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin developed by Unlimited Elements. The flaw affects all plugin versions up to and including 1.5.109. Authenticated attackers with low privileges can perform actions restricted to higher-privileged roles because the plugin fails to enforce proper authorization checks on sensitive functions. Successful exploitation impacts confidentiality, integrity, and availability of the affected WordPress site. The vulnerability was published to the National Vulnerability Database (NVD) on June 5, 2024.
Critical Impact
Authenticated low-privilege users can bypass access controls to execute privileged plugin operations, leading to full compromise of confidentiality, integrity, and availability on affected WordPress sites.
Affected Products
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress
- All versions from n/a through 1.5.109
- WordPress sites running the vulnerable unlimited-elements-for-elementor plugin
Discovery Timeline
- 2024-06-05 - CVE-2024-35674 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35674
Vulnerability Analysis
The vulnerability is classified as Missing Authorization [CWE-862]. The plugin exposes functionality that should be restricted to administrators but does not verify the acting user's capabilities before executing sensitive operations. An authenticated attacker who holds a low-privilege account, such as Subscriber or Contributor, can invoke these endpoints to escalate their effective permissions or manipulate plugin data. The attack originates over the network with low complexity and requires no user interaction. Because Elementor add-on plugins expose administrative widget, template, and configuration handling, an authorization bypass on these endpoints gives attackers a path to modify site content, alter templates, and stage further attacks.
Root Cause
The root cause is the absence of capability checks within one or more of the plugin's request handlers. Standard WordPress protection functions such as current_user_can() or wp_verify_nonce() are either missing or improperly applied on the affected actions. As a result, the plugin trusts any authenticated request without verifying that the caller holds the required role.
Attack Vector
Exploitation requires the attacker to hold a valid, low-privileged account on the target WordPress site. The attacker sends crafted HTTP requests directly to vulnerable plugin endpoints. Because no user interaction is needed, exploitation can be scripted against sites that permit open registration or that host compromised low-privilege accounts. See the Patchstack Vulnerability Report for technical details of the affected endpoints.
Detection Methods for CVE-2024-35674
Indicators of Compromise
- Unexpected admin-ajax.php or plugin REST requests originating from Subscriber or Contributor accounts targeting unlimited-elements-for-elementor handlers.
- Newly created or modified Elementor templates, widgets, or plugin settings without a corresponding administrator session.
- Creation of new administrative users or unexpected role changes shortly after low-privilege authentication events.
Detection Strategies
- Review WordPress access logs for POST requests to Unlimited Elements plugin endpoints from non-administrator sessions.
- Correlate authenticated session identifiers with the privilege level required for the invoked actions to surface authorization anomalies.
- Deploy web application firewall (WAF) rules that flag calls to the affected plugin actions when made by low-privilege roles.
Monitoring Recommendations
- Enable WordPress audit logging to capture role, capability, and template changes with user attribution.
- Alert on installation, activation, or modification of plugins and themes performed outside change windows.
- Monitor for outbound connections initiated from the web server that follow suspicious content changes, which may indicate follow-on payload delivery.
How to Mitigate CVE-2024-35674
Immediate Actions Required
- Update the Unlimited Elements For Elementor plugin to a version later than 1.5.109 as published by the vendor.
- Audit all WordPress user accounts and remove or disable unused low-privilege accounts, particularly Subscribers created via self-registration.
- Rotate credentials for any accounts that showed unusual activity against plugin endpoints.
Patch Information
The vendor has addressed the issue in a release subsequent to 1.5.109. Refer to the Patchstack Vulnerability Details advisory for the fixed version and confirm the installed build in the WordPress plugin dashboard.
Workarounds
- Disable the Unlimited Elements For Elementor plugin until the patched version can be deployed.
- Restrict access to wp-admin and admin-ajax.php using IP allowlisting or authenticated reverse proxy controls.
- Disable open user registration (Settings → General → Membership) to reduce the pool of low-privilege accounts available for abuse.
- Deploy a virtual patch through a WordPress-aware WAF that blocks unauthorized calls to the affected plugin actions.
# Configuration example: disable open registration and enforce least privilege via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin update unlimited-elements-for-elementor
wp plugin list --status=active --fields=name,version | grep unlimited-elements-for-elementor
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
