CVE-2021-24175

The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.

• CWE-287
• CWE-287

• https://posimyth.ticksy.com/ticket/2713734/Broken Link
• https://wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/Third Party Advisory
• https://posimyth.ticksy.com/ticket/2713734/Broken Link
• https://wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/Third Party Advisory

Published

Apr 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2417Vulnerability in the MySQL Server product of Oracle MySQL (c…6
• CVE-2021-24170The REST API endpoint get_users in the User Profile Picture …7.5
• CVE-2021-24171The WooCommerce Upload Files WordPress plugin before 59.4 ra…9.8
• CVE-2021-24172The VM Backups WordPress plugin through 1.0 does not have CS…4.3
• CVE-2021-24173The VM Backups WordPress plugin through 1.0 does not have CS…6.1
• CVE-2021-24174The Database Backups WordPress plugin through 1.2.2.6 does n…8.1
• CVE-2021-24176The JH 404 Logger WordPress plugin through 1.1 doesn't sanit…5.4
• CVE-2021-24177In the default configuration of the File Manager WordPress p…5.4
• CVE-2021-24178The Business Directory Plugin – Easy Listing Directories for…8.8
• CVE-2021-24179The Business Directory Plugin – Easy Listing Directories for…8.8
• CVE-2021-2418Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-24180Unvalidated input and lack of output encoding within the Rel…5.4