{"uuid": "1a6192d3-209b-438c-a186-051ecdacf111", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32243", "type": "seen", "source": "https://t.me/hacking_Attack/102643", "content": "Black Hat Ethical Hacking\nWordPress Websites at Risk \u2013 Hackers Exploit Critical Flaw in Essential Addons for Elementor\n\nWordPress Websites at Risk \u2013 Hackers Exploit Critical Flaw in Essential Addons for ElementorPost Views: 34 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nHackers have launched a widespread campaign, targeting vulnerable versions of the Essential Addons for Elementor plugin on thousands of WordPress websites through extensive internet scans. Their objective is to exploit a critical account password reset flaw that was recently disclosed.\n\nTracked as CVE-2023-32243, this critical-severity vulnerability affects Essential Addons for Elementor versions 5.4.0 to 5.7.1. Exploiting this flaw allows unauthenticated attackers to reset administrator account passwords and gain control of targeted websites.\n\nPatchStack, a security company, discovered the flaw on May 8th, 2023, and promptly alerted the plugin vendor. The vendor swiftly addressed the issue and released version 5.7.2 on May 11th to fix the vulnerability. PoCThe scale of the exploitation remained uncertain until recently. On May 14th, researchers made a proof-of-concept (PoC) exploit available on GitHub, exposing attackers to a widely accessible tool for carrying out the attacks.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nReports surfaced of a BleepingComputer reader and website owner who fell victim to hackers exploiting the flaw by resetting their admin password. However, it was still unclear how extensively this flaw was being exploited.\n\nA recent report by Wordfence sheds light on the matter, revealing that millions of probing attempts have occurred to identify websites vulnerable to this plugin. Wordfence successfully blocked over 6,900 exploitation attempts.\n\nJust a day after the flaw\u2019s disclosure, Wordfence recorded a staggering five million probing scans specifically targeting the plugin\u2019s \u2018readme.txt\u2019 file, which contains version information crucial for identifying vulnerable sites.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/WordPress/9/scans.png Number of recorded daily scans (Wordfence)\n\n\u201cWhile some services perform legitimate installation data probes, our data suggests that attackers began targeting vulnerable sites immediately after the flaw was disclosed,\u201d commented Wordfence in their report.\nTrending: Maximizing IDOR Detection with Burp Suite\u2019s Autorize Trending: OSINT Tool: GooFuzz The majority of these probing attempts originated from two IP addresses: \u2018185.496.220.26\u2019 and \u2018185.244.175.65.\u2019 When it comes to exploitation attempts, one IP address, \u201878.128.60.112,\u2019 accounted for a substantial volume of attacks by leveraging the PoC exploit released on GitHub. Several other high-ranking attacking IPs made between 100 and 500 attempts each.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/WordPress/9/ips.png Origin of most exploitation attempts (Wordfence)\n\nTo safeguard their websites, owners who utilize the \u2018Essential Addons for Elementor\u2019 plugin are strongly advised to update to version 5.7.2 or newer immediately. Given the vulnerability\u2019s high exploitability, Wordfence emphasizes the urgency of this update to prevent site compromise.\n\nAdditionally, website administrators should review the indicators of compromise outlined in Wordfence\u2019s report and add the identified malicious IP addresses to their blocklist to mitigate current and future attacks.\n\nWhile users of Wordfence\u2019s free security package are currently exposed to CVE-2023-32243, they can expect protection against this vulnerability on Jun[...]", "creation_timestamp": "2026-09-02T01:01:18.275197Z"}