A Critical Flaw in WordPress Sites Addons found in Elementor and Beaver Lets hack anyone the Site

Attention WordPress users!

Your website could easily get hacked if you are using "Ultimate Addons for Beaver Builder," or "Ultimate Addons for Elementor" and haven't recently updated them to the latest available versions.

Security researchers have discovered a critical yet easy-to-exploit authentication bypass vulnerability in both widely-used premium WordPress plugins that could allow remote attackers to gain administrative access to sites without requiring any password.

What's more worrisome is that opportunistic attackers have already started exploiting this vulnerability in the wild within 2 days of its discovery in order to compromise vulnerable WordPress websites and install a malicious backdoor for later access.

Both vulnerable plugins, made by software development company Brainstorm Force, are currently powering over hundreds of thousands of WordPress websites using Elementor and Beaver Builder frameworks, helping website admins and designers extend the functionality of their websites with more widgets, modules, page templates.

Discovered by researchers at web security service MalCare, the vulnerability resides in the way both plugins let WordPress account holders, including administrators, authenticate via Facebook and Google login mechanisms.

Image credit: WebARX

According to the vulnerability's advisory, due to lack of checks in the authentication method when a user login via Facebook or Google, vulnerable plugins can be tricked into allowing malicious users to login as any other targeted user without requiring any password.

"However, the Facebook and Google authentication methods did not verify the token returned by Facebook and Google, and since they don't require a password, there was no password check," explained WebARX researchers, who also analysed the flaw and confirmed its active exploitation.

"To exploit the vulnerability, the hacker needs to use the email ID of an admin user of the site. In most cases, this information can be retrieved fairly easily," MalCare said.

The attackers are abusing this flaw to install a fake SEO stats plugin after uploading a tmp.zip file on the targeted WordPress server, which eventually drops a wp-xmlrpc.php backdoor file to the root directory of the vulnerable site.

MalCare discovered this vulnerability on Wednesday that affects below-listed versions of the plugins and reported it to the developers on the same day, who then quickly addressed the issue and released patched versions of both within just 7 hours.

• Ultimate Addons for Elementor <= 1.20.0
• Ultimate Addons for Beaver Builder <= 1.24.0

The authentication bypass vulnerability has been patched with the release of "Ultimate Addons for Elementor version 1.20.1" and "Ultimate Addons for Beaver Builder version 1.24.1," which affected websites are highly recommended to install as soon as possible.