CVE-2024-47353: ElementsReady Open Redirect Vulnerability

CVE-2024-47353 Overview

CVE-2024-47353 is an open redirect vulnerability in the ElementsReady Addons for Elementor WordPress plugin from quomodosoft. The flaw affects all plugin versions up to and including 6.4.2. Attackers can craft URLs that redirect users from a trusted WordPress site to attacker-controlled destinations. The vulnerability is tracked under CWE-601 (URL Redirection to Untrusted Site).

Exploitation requires user interaction, typically clicking a malicious link. The bug is commonly abused in phishing campaigns to bypass URL reputation filters and lend legitimacy to attacker infrastructure.

Critical Impact
Attackers can leverage the trusted domain of a WordPress site running ElementsReady Addons for Elementor to redirect victims to phishing pages or malware delivery sites.

Affected Products

quomodosoft ElementsReady Addons for Elementor (free) — versions through 6.4.2
WordPress installations with the element-ready-lite plugin enabled
Sites relying on affected plugin builds for Elementor page-building functionality

Discovery Timeline

2024-10-11 - CVE-2024-47353 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47353

Vulnerability Analysis

The vulnerability resides in the ElementsReady Addons for Elementor plugin, which extends the Elementor page builder with additional widgets. A redirect parameter accepted by the plugin does not validate whether the target URL points to an allowed host. Attackers can supply an external URL, causing the plugin to forward the visitor to an arbitrary destination.

Open redirects like this one are frequently chained with phishing kits. The initial link appears to originate from a legitimate WordPress domain, which increases click-through rates and evades some email security gateways. The Patchstack advisory documents the vulnerability against the element-ready-lite package.

Because the flaw requires only network access and a victim clicking a crafted link, it is trivial to weaponize at scale. The scope change reflected in the vulnerability metrics indicates that impact extends beyond the vulnerable component to the browsing user.

Root Cause

The plugin accepts a user-controlled URL parameter and issues an HTTP redirect without applying an allowlist or same-origin check. Input validation is missing at the point where the redirect target is consumed, which is the defining condition of CWE-601.

Attack Vector

An attacker crafts a URL on the victim WordPress site that embeds an external destination in the vulnerable redirect parameter. The attacker distributes the link through email, social media, or messaging platforms. When a victim clicks the link, the plugin returns an HTTP redirect response pointing to the attacker's server. The victim's browser follows the redirect and loads the phishing or malware page.

Refer to the Patchstack Vulnerability Report for parameter-level technical details.

Detection Methods for CVE-2024-47353

Indicators of Compromise

Web server access logs showing HTTP 3xx responses from ElementsReady plugin endpoints with external URLs in query parameters
Referrer headers on phishing landing pages that point back to WordPress sites running element-ready-lite
User reports of unexpected redirects from trusted WordPress domains to unfamiliar destinations
Requests containing encoded URL parameters that resolve to hosts outside the site's own domain

Detection Strategies

Inspect WordPress access logs for requests to plugin routes carrying redirect, url, or return style parameters with off-site values
Enable and review Web Application Firewall (WAF) rules that flag open redirect patterns targeting WordPress plugins
Correlate outbound clicks from the site's domain with threat intelligence feeds tracking phishing infrastructure

Monitoring Recommendations

Alert on repeated redirect responses from the ElementsReady plugin to non-approved external hosts
Track sudden spikes in traffic to plugin endpoints, which may signal a phishing campaign leveraging the site
Monitor brand-abuse and URL-reputation services for entries that list the WordPress domain as a redirect hop

How to Mitigate CVE-2024-47353

Immediate Actions Required

Update ElementsReady Addons for Elementor to a version later than 6.4.2 as soon as the vendor publishes a fixed release
Audit the WordPress plugin inventory and disable element-ready-lite if a patched version is not yet available
Review recent web server logs for redirect abuse and notify users who may have clicked malicious links

Patch Information

The advisory published by Patchstack lists all versions up to and including 6.4.2 as vulnerable, with no fixed version referenced in the enriched data at the time of writing. Administrators should monitor the Patchstack Vulnerability Report and the plugin's WordPress.org page for updates.

Workarounds

Deploy WAF rules that block requests to the plugin's redirect endpoints when the target parameter references an external host
Restrict access to the vulnerable plugin routes via web server configuration until a patch is applied
Educate users to inspect the full URL before clicking links that appear to originate from the WordPress site

bash

# Example nginx rule to block off-site redirect parameters
location ~* /wp-content/plugins/element-ready-lite/ {
    if ($arg_redirect ~* "^https?://(?!yourdomain\.com)") {
        return 403;
    }
    if ($arg_url ~* "^https?://(?!yourdomain\.com)") {
        return 403;
    }
}