CVE-2024-13808: RCE in Xpro Elementor Addons - Pro

This RCE vulnerability allows an authenticated attacker to gain complete control over the affected WordPress server. An attacker with Contributor access can upload and execute malicious PHP code, potentially leading to data breaches, website defacement, malware installation, or complete server compromise. The blast radius extends to any sensitive data stored on the server, including user credentials, database information, and configuration files. Successful exploitation could also facilitate lateral movement to other systems within the network if the WordPress server has access to them. This vulnerability shares similarities with other plugin-based RCE exploits where insufficient input validation allows for code injection.

1. Reserved2025-01-30
2. Published2025-04-26
3. Modified2025-04-28
4. EPSS updated2026-04-02

The primary mitigation is to immediately upgrade Xpro Elementor Addons - Pro to a version higher than 1.4.9, as the vendor has released a patch. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily restricting access to the custom PHP widget functionality. Web Application Firewalls (WAFs) configured to detect and block PHP code execution attempts targeting the widget endpoint can provide an additional layer of defense. Monitor WordPress logs for suspicious activity, particularly requests related to the custom PHP widget. Implement strict user access controls to limit the number of users with Contributor-level access or higher.

Active installs

30KKnown

Plugin rating