Essential Addons for Elementor 5.4.0-5.7.1 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
Title source: llmExploitation Summary
CVE-2023-32243 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 9 public exploits from researchers including RandomRobbieBF, Jenderal92, gbrsh. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit targets CVE-2023-32243, an unauthenticated privilege escalation vulnerability in Essential Addons for Elementor (versions 5.4.0-5.7.1). It resets arbitrary user passwords by exploiting improper validation of password reset keys.
Description
Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.
Exploits (9)
This exploit targets CVE-2023-32243, an unauthenticated privilege escalation vulnerability in Essential Addons for Elementor (versions 5.4.0-5.7.1). It resets arbitrary user passwords by exploiting improper validation of password reset keys.
This PoC exploits CVE-2023-32243, an authentication bypass vulnerability in WordPress plugins, by resetting user passwords via an AJAX endpoint. It automates the process of retrieving usernames and triggering password resets.
This exploit targets CVE-2023-32243, an unauthorized account takeover vulnerability in Essential Addons for Elementor. It leverages a nonce bypass to reset the password of any user without authentication.
This PoC exploits CVE-2023-32243, an authentication bypass vulnerability in Essential Addons for Elementor (versions 5.4.0 to 5.7.1), allowing password reset for arbitrary users via a crafted admin-ajax.php request. It automates version checking, username extraction, nonce retrieval, and password reset.
This exploit PoC targets CVE-2023-32243, an authentication bypass vulnerability in the Essential Addons for Elementor plugin for WordPress. It automates the process of identifying vulnerable versions, extracting usernames, and resetting passwords to gain unauthorized access.
This PoC exploits CVE-2023-32243, a vulnerability in the Essential Addons for Elementor plugin, allowing password reset for arbitrary users via a nonce bypass. It sends a crafted POST request to reset the password of a specified user.
This repository is a detailed writeup and demonstration of CVE-2023-32243, a privilege escalation vulnerability in the Essential Addons for Elementor WordPress plugin. It includes environment setup, detection strategies, and mitigation techniques but does not contain exploit code itself.
This repository contains a proof-of-concept exploit for CVE-2023-32243, targeting a vulnerability in the Akismet plugin for WordPress. The exploit involves JavaScript-based keylogging and input tracking to bypass anti-spam mechanisms.
This PoC exploits CVE-2023-32243, an authentication bypass vulnerability in Essential Addons for Elementor, by resetting user passwords without proper authorization. It automates version checking, username enumeration, nonce extraction, and password reset via admin-ajax.php.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H