Your website could easily get hacked if you are using “Ultimate Addons for Beaver Builder,” or “Ultimate Addons for Elementor” and haven’t recently updated them to the latest available versions.
Security researchers have discovered a critical yet easy-to-exploit authentication bypass vulnerability in both widely-used premium WordPress plugins that could allow remote attackers to gain administrative access to sites without requiring any password.
Both vulnerable plugins, made by software development company Brainstorm Force, are currently powering over hundreds of thousands of WordPress websites using Elementor and Beaver Builder frameworks, helping website admins and designers extend the functionality of their websites with more widgets, modules, page templates.
Discovered by researchers at web security service MalCare, the vulnerability resides in the way both plugins let WordPress account holders, including administrators, authenticate via Facebook and Google login mechanisms.
According to the vulnerability’s advisory, due to lack of checks in the authentication method when a user login via Facebook or Google, vulnerable plugins can be tricked into allowing malicious users to login as any other targeted user without requiring any password.
“However, the Facebook and Google authentication methods did not verify the token returned by Facebook and Google, and since they don’t require a password, there was no password check,” explained WebARX researchers, who also analysed the flaw and confirmed its active exploitation.
MalCare discovered this vulnerability on Wednesday that affects below-listed versions of the plugins and reported it to the developers on the same day, who then quickly addressed the issue and released patched versions of both within just 7 hours.
- Ultimate Addons for Elementor <= 1.20.0
- Ultimate Addons for Beaver Builder <= 1.24.0