Elementor Page Builder versions less than 1.8 contain a major security issue that allows logged in users (not just admin) unrestricted access to the Elementor specific backend functions.  This allows unrestricted importing/exporting of content and potentially complete site compromise. The WordPress.org repository claims there are over 300,000 active installations.

If you are running an older version, upgrade immediately.  The Elementor team did not appear to be planning any disclosure or notification and the only indication in the changelog of any potential issues is “Fix! – Patched nonce validation for all library actions” along with additional nonce related fixes over the next few days to deal with bugs related to this patching.

Details

Due to the large number of installs I will not describe the exact steps to exploit these methods.  Many of the AJAX actions are accessible to any logged in user.  Some of the actions are protected with the ‘elementor-editing’ nonce, unfortunately that was leaked to any logged in user via the WordPress heartbeat.

Timeline

• 10/17/2017 Sent initial contact inquiry
• 10/18/2017 Received response and disclosure sent
• 10/26/2017 Followup message sent to check status
• 11/7/2017 Version 1.8.0 released