CVE-2021-24175: posimyth the_plus_addons_for_elementor Improper Authentication
Vulnerability summary
CVE-2021-24175 is a critical (CVSS 9.8) Improper Authentication vulnerability in posimyth the_plus_addons_for_elementor. EPSS estimates a 14.46% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 05-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
14.46%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 14.46% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Posimyth1 product
Unknown1 product
- the plus addons for elementor page builder≥ 4.1.7, < 4.1.7
Wordpress1 product
- theplus_elementor_addon< 4.1.7
3 vendors · 3 products
References
4 links- wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89X Refsource CONFIRMExploitThird Party Advisory
- www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/X Refsource MISCThird Party Advisory