CVE-2023-33930

The vulnerability, classified as CWE-434, involves insufficient validation of uploaded file types. An attacker with administrator privileges can upload a file containing malicious code (e.g., webshell) in a format that the server then executes. According to references, the mechanism involves unrestricted ZIP archive extraction, allowing arbitrary files to be placed and executed on the server side. The vulnerability has a scope extending beyond the component (Scope: Changed), indicating potential takeover of resources beyond the plugin itself.

An attacker can gain the ability to execute arbitrary code on the server (RCE), leading to complete system takeover — compromising confidentiality, integrity, and availability of data and services.

Update the Unlimited Elements For Elementor plugin to a version higher than 1.5.66. Details regarding the patched version are available in the vendor references (Patchstack). Additionally, it is recommended to restrict administrative privileges to trusted users and monitor file uploads on the server.

The Unlimited Elements For Elementor plugin (Free Widgets, Addons, Templates) in versions from the beginning up to and including 1.5.66, running on the WordPress platform.