CVE-2023-5360: WordPress Royal Elementor Plugin Zero-Day Fix

The security landscape for WordPress sites has always been a subject of critical importance, given the CMS's popularity. Recently, a significant zero-day vulnerability was discovered in a popular WordPress plugin called Royal Elementor Addons and Templates. In this article, we delve into the details of the CVE-2023-5360 vulnerability, its potential impact, and the recommendations for safeguarding your website.

Risk Scoring: Understanding the Threat Level

The CVE-2023-5360 vulnerability has received a Common Vulnerability Scoring System (CVSSv3) score of 9.8, signaling a critical level of risk. For context, the CVSS scale runs from 0 to 10, with higher numbers indicating greater severity. A score of 9.8 suggests that immediate action is required to mitigate the risks associated with this vulnerability.

Technical Details of the Vulnerability

The Royal Elementor Addons and Templates plugin, which boasts over 200,000 active installations, is essentially a tool that enables users to create web elements without needing coding skills. The vulnerability in question allows unauthenticated attackers to upload arbitrary files onto vulnerable websites. While the plugin does attempt to validate file extensions, it fails to properly sanitize user inputs, leading to potential remote code execution. Most payloads deployed in these attacks attempt to either create a new WordPress administrator user or act as a backdoor for the attackers.

Affected Products

The versions of Royal Elementor Addons and Templates that are vulnerable are all versions below 1.3.79. It's critical that users update their plugin to version 1.3.79 or later to mitigate the risks.

The State of Ongoing Attacks

According to security firms Wordfence and WPScan, this vulnerability has been actively exploited since August 30, 2023. Wordfence reported blocking over 46,000 attacks targeting this plugin, and WPScan has recorded 889 cases of distinct payloads being deployed post-exploitation, as of October 3, 2023.

Recommendations for Mitigation

Immediate Action

1. Upgrade the Plugin: All users of this add-on should update to the latest version (1.3.79) as soon as possible.
2. Run a Malware Scan: It’s recommended to run a scan using Wordfence CLI or the Wordfence plugin if you've been using the Royal Elementor Addons and Templates plugin.
3. Free Scanning Solutions: In the absence of commercial solutions, free scanners are available to assess your website's vulnerability.
4. Cleanup: Simply updating the plugin will not remove any existing malicious files or infections. A full website cleanup is necessary in such cases.

Long-term Measures

1. Regular Software Updates: Keep all your WordPress plugins and themes up to date to reduce vulnerability.
2. User Training: Educate administrators and content creators on how to recognize potential security threats and phishing attempts.
3. Network Security: Utilize network security measures such as firewalls and intrusion detection systems to minimize risks.
4. Incident Response Plan: Establish an incident response plan for quick action in case of future vulnerabilities.

Final Thoughts

This zero-day vulnerability in the Royal Elementor Addons and Templates plugin highlights the importance of maintaining updated security protocols for WordPress websites. It serves as a critical reminder that even popular plugins can contain severe vulnerabilities. Following the immediate action steps and long-term recommendations listed above can significantly reduce your site's risk profile.