CVE-2022-1329: elementor website_builder
Vulnerability summary
CVE-2022-1329 is a high (CVSS 8.8) vulnerability in elementor website_builder. EPSS estimates a 92.66% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 4 public exploits are recorded. Fixed in 3.6.3.
Timeline
- 19-04-2022PublishedVulnerability first disclosed.
- 07-02-2025Last modifiedVulnerability information updated.
Description
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
CVSS metrics
4 scores · 3 sources · 2 versions- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
92.66%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 92.66% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (wordfence.com)
Maturity: unknown
Exploit Reference (pluginvulnerabilities.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Elementor1 product
- website_builder≥ 3.6.0, ≤ 3.6.2
Elemntor1 product
- elementor website builder3.6.0 | 3.6.1 | 3.6.2
Wordpress1 product
- elementor≥ 3.6.0, ≤ 3.6.2 (fixed in 3.6.3)
3 vendors · 3 products
References
5 links- www.wordfence.com/blog/2022/04/elementor-critical-remote-code-execution-vulnerability/ExploitThird Party Advisory
- plugins.trac.wordpress.org/changeset/2708766/elementor/trunk/core/app/modules/onboarding/module.phpPatchRelease NotesVendor Advisory
- packetstormsecurity.com/files/168615/WordPress-Elementor-3.6.2-Shell-Upload.htmlExploitThird Party AdvisoryVDB Entry