CVE-2022-0320
Last modified
CVE-2022-0320 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.. EPSS estimates a 1.99% chance of exploitation in the next 30 days.
Description
The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wpdeveloper | Essential Addons For Elementor | < 5.0.5 |
References
- https://wpscan.com/vulnerability/0d02b222-e672-4ac0-a1d4-d34e1ecf4a95Third Party Advisory
- https://wpscan.com/vulnerability/0d02b222-e672-4ac0-a1d4-d34e1ecf4a95Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-0320?
How severe is CVE-2022-0320?
How do I fix CVE-2022-0320?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-0314The Nimble Page Builder WordPress plugin before 3.2.2 does n…6.1
- CVE-2022-0315Insecure Temporary File in GitHub repository horovod/horovod…7.5
- CVE-2022-0316The WeStand WordPress theme before 2.1, footysquare WordPres…9.8
- CVE-2022-0317An improper input validation vulnerability in go-attestation…3.3
- CVE-2022-0318Heap-based Buffer Overflow in vim/vim prior to 8.2.9.8
- CVE-2022-0319Out-of-bounds Read in vim/vim prior to 8.2.5.5
- CVE-2022-0321The WP Voting Contest WordPress plugin before 3.0 does not s…6.1
- CVE-2022-0322A flaw was found in the sctp_make_strreset_req function in n…5.5
- CVE-2022-0323Improper Neutralization of Special Elements Used in a Templa…8.8
- CVE-2022-0324There is a vulnerability in DHCPv6 packet parsing code that …7.5
- CVE-2022-0326NULL Pointer Dereference in Homebrew mruby prior to 3.2.5.5
- CVE-2022-0327The Master Addons for Elementor WordPress plugin before 1.8.…6.1
Are you affected by CVE-2022-0320?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST