CVE-2024-3668 Overview
CVE-2024-3668 is a privilege escalation vulnerability in the PowerPack Pro for Elementor plugin for WordPress. The flaw affects all versions up to and including 2.10.17. The plugin fails to restrict low-privileged users from setting a default role for a registration form. Authenticated attackers with contributor-level access or above can create a registration form that assigns administrator as the default role, then register a new account with full administrator privileges. The weakness is categorized as [CWE-732] Incorrect Permission Assignment for Critical Resource.
Critical Impact
A contributor-level user can escalate to full WordPress administrator, gaining complete control over the site, its content, users, and installed plugins.
Affected Products
- Ideabox PowerPack Pro for Elementor (WordPress plugin)
- All versions up to and including 2.10.17
- WordPress sites running the Pro edition with the registration form widget enabled
Discovery Timeline
- 2024-06-08 - CVE-2024-3668 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3668
Vulnerability Analysis
The PowerPack Pro for Elementor plugin provides a registration form widget that supports assigning a default WordPress role to newly registered users. The plugin does not enforce a capability check when a lower-privileged editor saves the widget configuration. As a result, any user with contributor-level access or higher can author or edit a page, embed the registration form widget, and configure the default_role field to administrator.
Once the form is published, anyone submitting it—including the attacker in an unauthenticated context—is registered as a WordPress administrator. The vulnerability converts a contributor account, which normally cannot publish content or manage plugins, into a full site takeover primitive. Impact includes arbitrary plugin and theme installation, PHP code execution through malicious plugins, database access, and pivoting to underlying hosting infrastructure.
Root Cause
The root cause is missing authorization on a security-sensitive configuration field. The plugin trusts the role value submitted by any authenticated user who can edit an Elementor widget. WordPress core capabilities such as promote_users and create_users are never validated against the current user before persisting the role selection.
Attack Vector
The attack requires network access to the WordPress site and an authenticated account at contributor level or higher. The attacker edits or creates a page in Elementor, inserts the PowerPack Registration Form widget, sets the default role to administrator, publishes the page, then submits the form to receive an administrator account.
No verified public exploit code is referenced in the enriched CVE data. See the Wordfence Vulnerability Report for the technical write-up.
Detection Methods for CVE-2024-3668
Indicators of Compromise
- Unexpected WordPress user accounts with the administrator role created after a legitimate contributor or author session.
- Elementor pages containing a PowerPack Registration Form widget where the default role attribute is set to administrator.
- Recent edits by contributor or author accounts to pages that host registration widgets.
- New plugins, themes, or PHP files uploaded shortly after an unexplained administrator account appears.
Detection Strategies
- Audit the wp_users and wp_usermeta tables for accounts whose wp_capabilities value is administrator and correlate against user_registered timestamps.
- Inspect Elementor post meta (_elementor_data) for registration form widgets carrying a default_user_role of administrator.
- Review web server access logs for POST requests to registration endpoints followed by successful administrator logins from the same IP.
Monitoring Recommendations
- Alert on any WordPress role change to administrator that is not initiated by an existing administrator.
- Monitor plugin and theme installation events, since they are common follow-on actions after privilege escalation.
- Track authentication events for freshly created accounts logging in immediately after registration.
How to Mitigate CVE-2024-3668
Immediate Actions Required
- Update PowerPack Pro for Elementor to a version later than 2.10.17 as listed in the PowerPack Change Logs.
- Enumerate all WordPress administrator accounts and remove any that were not explicitly provisioned by the site owner.
- Rotate credentials for all remaining administrator accounts and force a password reset for lower-privileged users.
- Review recently edited Elementor pages for embedded registration form widgets and remove any that assign privileged roles.
Patch Information
Ideabox addressed the flaw in a release published after 2.10.17. Consult the PowerPack Change Logs for the fixed version and confirm the installed release meets or exceeds it. The patch enforces a capability check so that only users allowed to manage roles can configure the registration form's default role.
Workarounds
- Restrict contributor and author accounts on sites that cannot immediately patch, limiting who can edit pages containing PowerPack widgets.
- Disable the PowerPack Registration Form widget through Elementor's widget settings until the plugin is upgraded.
- Enforce the WordPress DISALLOW_FILE_MODS constant to prevent post-compromise plugin or theme installation from a hijacked administrator account.
- Place the WordPress admin area behind a web application firewall rule that blocks role assignment parameters set to administrator from non-admin users.
# Configuration example: verify installed PowerPack version and update via WP-CLI
wp plugin get powerpack-elementor-addons-pro --field=version
wp plugin update powerpack-elementor-addons-pro
wp user list --role=administrator --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
