{"vulnerability": "cve-2022-1329", "sightings": [{"uuid": "bbe2cd0f-19e4-466c-8d37-b5af07b6a7ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "bd5f87f5-6d29-4d23-acd6-3d8edfe10b24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:42.000000Z"}, {"uuid": "388569cd-d96d-429e-ab00-06e11a1eaeb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_plugin_elementor_auth_upload_rce.rb", "content": "", "creation_timestamp": "2022-10-03T21:25:05.000000Z"}, {"uuid": "f5d84733-e897-43b2-9a08-f2e1a2da1387", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "published-proof-of-concept", "source": "https://t.me/ARC15INFO/582", "content": "CVE-2022-1329\nWordPress-Elementor-3.6.0-3.6.1-3.6.2\ntype: RCE\n#exploit #rce #poc", "creation_timestamp": "2024-08-29T06:24:30.000000Z"}, {"uuid": "302d9ec0-0c0d-4b49-bf0a-e70b471d31c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "published-proof-of-concept", "source": "https://t.me/ARC15INFO/422", "content": "CVE-2022-1329\nWordPress-Elementor-3.6.0-3.6.1-3.6.2\ntype: RCE\n#exploit #rce #poc", "creation_timestamp": "2024-08-29T06:24:29.000000Z"}, {"uuid": "96cb4a0b-9766-40c6-9f03-1dec03edef1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "published-proof-of-concept", "source": "https://t.me/ARC15INFO/396", "content": "CVE-2022-1329\nWordPress-Elementor-3.6.0-3.6.1-3.6.2\ntype: RCE\n#exploit #rce #poc", "creation_timestamp": "2024-08-29T06:24:29.000000Z"}, {"uuid": "bd616e1c-2725-4c21-96b3-27c67d263a78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/803", "content": "CVE-2022-1329\nWordPress-Elementor-3.6.0-3.6.1-3.6.2\ntype: RCE\n#exploit #rce #poc", "creation_timestamp": "2022-04-17T06:23:53.000000Z"}, {"uuid": "1cc485ae-184a-45fd-9abd-171f4d72793e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "seen", "source": "https://t.me/breachdetector/120206", "content": "\u26a0 Detectada filtraci\u00f3n \u26a0\n{\n  \"site\": \"Sinister.ly\",\n  \"Threat Actor\": \"bugsbunny\",\n  \"Content\": \"CVE-2022-1329 vulnerability exploit\",\n  \"Detection Date\": \"04 Aug 2022 09:31\",\n  \"Type\": \"Data leak\"\n}\n\ud83d\udd39 Data Leak monitoring system\ud83d\udd39", "creation_timestamp": "2022-08-04T09:43:39.000000Z"}, {"uuid": "c979d5f6-1940-44d9-93ff-70bc99d55ae3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "published-proof-of-concept", "source": "https://t.me/MrVGunz/120", "content": "CVE-2022-1329\nWordPress-Elementor-3.6.0-3.6.1-3.6.2\ntype: RCE", "creation_timestamp": "2022-04-17T22:20:29.000000Z"}, {"uuid": "dc4b0ac0-af4d-4404-ba26-38e24c77f883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "published-proof-of-concept", "source": "Telegram/vs3Qq4zbd3HTy0CMtgV23TLHfaXowBghyqD3hNne4gw0eac", "content": "", "creation_timestamp": "2023-02-03T04:51:15.000000Z"}, {"uuid": "68406ac4-4c09-4db9-a9e5-59f504a849ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "seen", "source": "https://t.me/cibsecurity/41119", "content": "\u203c CVE-2022-1329 \u203c\n\nThe Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-20T00:24:50.000000Z"}, {"uuid": "cbf1db29-a51e-448f-99e5-1381a6605b41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/52", "content": "", "creation_timestamp": "2022-04-19T03:27:40.000000Z"}, {"uuid": "8c79d6f3-174f-4a22-a6ec-134450a7a3d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "published-proof-of-concept", "source": "https://t.me/LearnExploit/3397", "content": "CVE-2022-1329\nWordPress-Elementor-3.6.0-3.6.1-3.6.2\ntype: RCE\n\n#exploit #rce #poc\n\u2014\u2014\u2014\u2014\u2014\u2014\u2067\n0Day.Today\n@LearnExploit\n@Tech_Army", "creation_timestamp": "2022-04-18T04:21:33.000000Z"}, {"uuid": "1bd0066d-2339-4244-9d0f-ca745ca62774", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "published-proof-of-concept", "source": "Telegram/YAxUY8SPHS6tTvuGzJrwH116Yde__oWJ4rRTUv8d8D1y4Ww", "content": "", "creation_timestamp": "2026-08-30T00:00:52.729105Z"}, {"uuid": "c82c4bbb-f61a-4279-b36e-9c70fd59b102", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "seen", "source": "Telegram/YAxUY8SPHS6tTvuGzJrwH116Yde__oWJ4rRTUv8d8D1y4Ww", "content": "", "creation_timestamp": "2026-08-29T19:00:04.213094Z"}, {"uuid": "817a1940-4904-4b16-b7c0-06cb444eb14f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "seen", "source": "https://t.me/hacking_Attack/49865", "content": "Exploit Collector\nWordPress Elementor 3.6.2 Remote Code Execution\n\nhttps://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png \nWordPress Elementor versions 3.6.0 through 3.6.2 suffer from a remote code execution vulnerability.\n\nMD5 | e3c26b5f04706dd80b2cb9e18d638d8a\n\nDownload\nDescription: Insufficient Access Control leading to Subscriber+ Remote Code Execution\n\nAffected Plugin: Elementor\n\nPlugin Slug: elementor\n\nPlugin Developer: Elementor\n\nAffected Versions: 3.6.0 \u2013 3.6.2\n\nCVE ID: CVE-2022-1329\n\nCVSS Score: 9.9(Critical)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n\nResearcher/s: Ramuel Gall\n\nFully Patched Version: 3.6.3\n\nThe Elementor plugin for WordPress introduced an Onboarding module in version 3.6.0, designed to simplify the initial setup of the plugin. The module uses an unusual method to register AJAX actions, adding an admin_init listener in its constructor that first checks whether or not a request was to the AJAX endpoint and contains a valid nonce before calling the maybe_handle_ajax function.\n\nUnfortunately no capability checks were used in the vulnerable versions. There are a number of ways for an authenticated user to obtain the Ajax::NONCE_KEY, but one of the simplest ways is to view the source of the admin dashboard as a logged-in user, as it is present for all authenticated users, even for subscriber-level users.\n\nThis means that any logged-in user could use any of the onboarding functions. Additionally, an unauthenticated attacker with access to the Ajax::NONCE_KEY could use any of the functions called from maybe_handle_ajax, though this would likely require a separate vulnerability.\n\nThe function with the most severe impact was the upload_and_install_pro function. An attacker could craft a fake malicious \u201cElementor Pro\u201d plugin zip and use this function to install it. Any code present in the fake plugin would be executed, which could be used to take over the site or access additional resources on the server.\n\nIn addition to this functionality, a less sophisticated attacker could simply deface the site by using the maybe_update_site_name, maybe_upload_logo_image, and maybe_update_site_logo functions to change the site name and logo.\n\nTimeline\n\nMarch 29, 2022 \u2013 We finish our investigation and deploy a firewall rule to protect Wordfence Premium, Wordfence Care, and Wordfence Response customers. We send our full disclosure to the plugin developer\u2019s official security contact.\n\nApril 5, 2022 \u2013 We follow up with the plugin developer\u2019s security contact as we have not yet received a response.\n\nApril 11, 2022 \u2013 We send our full disclosure to the WordPress Plugins team.\n\nApril 12, 2022 \u2013 A patched version of Elementor is released.\n\nApril 28, 2022 \u2013 The firewall rule becomes available to free Wordfence users.\n\nConclusion\n\nIn today\u2019s post, we covered a Critical vulnerability that allows any authenticated user to upload and execute malicious code on a site running a vulnerable version of the Elementor plugin. If your site is using the Elementor plugin, we urge you to update immediately. The good news is that the vulnerability is not present in versions prior to 3.6.0 and was successfully patched in 3.6.3.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:45.770742Z"}, {"uuid": "fd023130-2065-4c78-b021-e1fd761b8994", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1329", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49865", "content": "Exploit Collector\nWordPress Elementor 3.6.2 Remote Code Execution\n\nhttps://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png \nWordPress Elementor versions 3.6.0 through 3.6.2 suffer from a remote code execution vulnerability.\n\nMD5 | e3c26b5f04706dd80b2cb9e18d638d8a\n\nDownload\nDescription: Insufficient Access Control leading to Subscriber+ Remote Code Execution\n\nAffected Plugin: Elementor\n\nPlugin Slug: elementor\n\nPlugin Developer: Elementor\n\nAffected Versions: 3.6.0 \u2013 3.6.2\n\nCVE ID: CVE-2022-1329\n\nCVSS Score: 9.9(Critical)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n\nResearcher/s: Ramuel Gall\n\nFully Patched Version: 3.6.3\n\nThe Elementor plugin for WordPress introduced an Onboarding module in version 3.6.0, designed to simplify the initial setup of the plugin. The module uses an unusual method to register AJAX actions, adding an admin_init listener in its constructor that first checks whether or not a request was to the AJAX endpoint and contains a valid nonce before calling the maybe_handle_ajax function.\n\nUnfortunately no capability checks were used in the vulnerable versions. There are a number of ways for an authenticated user to obtain the Ajax::NONCE_KEY, but one of the simplest ways is to view the source of the admin dashboard as a logged-in user, as it is present for all authenticated users, even for subscriber-level users.\n\nThis means that any logged-in user could use any of the onboarding functions. Additionally, an unauthenticated attacker with access to the Ajax::NONCE_KEY could use any of the functions called from maybe_handle_ajax, though this would likely require a separate vulnerability.\n\nThe function with the most severe impact was the upload_and_install_pro function. An attacker could craft a fake malicious \u201cElementor Pro\u201d plugin zip and use this function to install it. Any code present in the fake plugin would be executed, which could be used to take over the site or access additional resources on the server.\n\nIn addition to this functionality, a less sophisticated attacker could simply deface the site by using the maybe_update_site_name, maybe_upload_logo_image, and maybe_update_site_logo functions to change the site name and logo.\n\nTimeline\n\nMarch 29, 2022 \u2013 We finish our investigation and deploy a firewall rule to protect Wordfence Premium, Wordfence Care, and Wordfence Response customers. We send our full disclosure to the plugin developer\u2019s official security contact.\n\nApril 5, 2022 \u2013 We follow up with the plugin developer\u2019s security contact as we have not yet received a response.\n\nApril 11, 2022 \u2013 We send our full disclosure to the WordPress Plugins team.\n\nApril 12, 2022 \u2013 A patched version of Elementor is released.\n\nApril 28, 2022 \u2013 The firewall rule becomes available to free Wordfence users.\n\nConclusion\n\nIn today\u2019s post, we covered a Critical vulnerability that allows any authenticated user to upload and execute malicious code on a site running a vulnerable version of the Elementor plugin. If your site is using the Elementor plugin, we urge you to update immediately. The good news is that the vulnerability is not present in versions prior to 3.6.0 and was successfully patched in 3.6.3.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T01:00:04.826007Z"}]}