CVE-2020-13125

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

2.31%

Published

May 16, 2020

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

TrickestTrickest PoC index NucleiNuclei detection template

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Products (1)

brainstormforce · ultimate_addons_for_elementor (up to 1.24.2)vulnerable

References (4)

https://wpvulndb.com/vulnerabilities/10214

Not Applicable

https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk/

Third Party Advisory

https://wpvulndb.com/vulnerabilities/10214

Not Applicable

https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk/

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs