CVE-2023-31231

The vulnerability classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) involves the lack of proper validation of the file extension or type being uploaded. An authenticated user (even with low privileges) can upload an executable file, such as a PHP script, through the vulnerable upload mechanism of the plugin. Once such a file is placed on the server, an attacker can invoke it through a browser and execute arbitrary code in the context of the web server. The CVSS vector indicates a change in scope (Scope Changed), which means the impact may extend beyond the WordPress application itself.

An attacker can gain full control over the server through remote code execution (RCE), and can also compromise the confidentiality, integrity, and availability of data and the entire hosting environment.

The Unlimited Elements For Elementor plugin should be immediately updated to a version higher than 1.5.65. Details regarding the patched version are available in the manufacturer's references and in the Patchstack database.

The Unlimited Elements For Elementor plugin (Free Widgets, Addons, Templates) in versions from the beginning up to and including 1.5.65, installed on the WordPress platform.