CVE-2024-47361: Elementor Addon Elements Auth Bypass Flaw

CVE-2024-47361 Overview

CVE-2024-47361 is a Missing Authorization vulnerability [CWE-862] in the WPVibes Elementor Addon Elements plugin (addon-elements-for-elementor-page-builder) for WordPress. The flaw affects all versions up to and including 1.13.6. Authenticated users with low privileges can invoke plugin functionality that lacks proper authorization checks, leading to broken access control. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact
Authenticated attackers with low-privilege accounts can bypass authorization controls in the Elementor Addon Elements plugin and perform restricted actions on WordPress sites running versions <= 1.13.6.

Affected Products

WPVibes Elementor Addon Elements (addon-elements-for-elementor-page-builder) plugin for WordPress
All versions from initial release through 1.13.6
WordPress sites using the plugin alongside Elementor Page Builder

Discovery Timeline

2024-11-01 - CVE-2024-47361 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47361

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the Elementor Addon Elements plugin. The plugin exposes functionality that fails to verify whether the caller has the required capability or permission level before executing sensitive operations. An authenticated attacker with any low-privilege role, such as Subscriber, can reach these code paths.

Because the network attack path only requires low privileges and no user interaction, exploitation is straightforward on any WordPress instance where user registration is enabled or where attacker-controlled low-privilege accounts already exist. Successful exploitation compromises site content, plugin configuration, and site availability.

Root Cause

The root cause is a broken access control pattern [CWE-862]. Plugin endpoints, likely implemented as WordPress AJAX actions (wp_ajax_*) or REST routes, execute without invoking current_user_can() capability checks or nonce verification tied to authorized roles. The plugin trusts that any authenticated request is legitimate, ignoring the WordPress role model.

Attack Vector

An attacker first obtains a valid low-privilege WordPress account on the target site. The attacker then sends crafted HTTP requests directly to the vulnerable plugin actions using the authenticated session cookie or nonce. Because the plugin does not confirm the user's authorization level, the request is processed as though issued by a privileged user.

No verified public proof-of-concept code has been published. Technical details are documented in the Patchstack WordPress Plugin Vulnerability database entry.

Detection Methods for CVE-2024-47361

Indicators of Compromise

Unexpected modifications to Elementor templates, widgets, or plugin settings performed by non-administrator accounts
HTTP POST requests from low-privilege user sessions to admin-ajax.php referencing Elementor Addon Elements actions
New or altered pages, posts, or widget configurations correlating with subscriber-level authenticated sessions
Anomalous plugin option changes in wp_options without a corresponding administrator login event

Detection Strategies

Inventory WordPress installations and identify sites running addon-elements-for-elementor-page-builder at version 1.13.6 or earlier
Review web server access logs for authenticated requests to plugin AJAX endpoints originating from Subscriber or Contributor roles
Correlate WordPress audit logs with request logs to detect privileged actions triggered by low-privilege accounts

Monitoring Recommendations

Enable a WordPress activity logging plugin to record user role, action, and affected object for every state change
Forward WordPress and web server logs to a centralized log platform for correlation and alerting on role-versus-action mismatches
Alert on newly registered low-privilege accounts followed by immediate requests to wp-admin/admin-ajax.php

How to Mitigate CVE-2024-47361

Immediate Actions Required

Update the Elementor Addon Elements plugin to a version later than 1.13.6 as soon as the vendor publishes a fixed release
Audit existing WordPress user accounts and remove untrusted low-privilege users
Disable open user registration (Settings > General > Membership) if it is not required for site operation
Rotate credentials and review recent changes to Elementor templates and site content for signs of tampering

Patch Information

Refer to the Patchstack advisory for the current fixed version and vendor patch status. Apply the vendor-supplied update through the WordPress plugin manager once available.

Workarounds

Deactivate and remove the Elementor Addon Elements plugin until a patched version is installed
Restrict access to wp-admin/admin-ajax.php at the web application firewall (WAF) layer for authenticated low-privilege roles where feasible
Enforce least privilege by ensuring only trusted editors and administrators can authenticate to the site

bash

# Example WP-CLI commands to identify and disable the vulnerable plugin
wp plugin list --name=addon-elements-for-elementor-page-builder --fields=name,status,version
wp plugin deactivate addon-elements-for-elementor-page-builder
wp user list --role=subscriber --fields=ID,user_login,user_registered