CVE-2023-0443: unknown anywhere elementor
CVSS: 8.6v3.1HighModified
Published 30-05-2023Last modified 10-01-2025
Vulnerability summary
CVE-2023-0443 is a high (CVSS 8.6) vulnerability in unknown anywhere elementor. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.7% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.2.8.
CVSS score
8.6/10
010
High · v3.1 (wordfence)EPSS score
0.62%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 30-05-2023PublishedVulnerability first disclosed.
- 10-01-2025Last modifiedVulnerability information updated.
Description
The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 8.6Preferred score · wordfence (Source)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NSources3 sources · 5.3–8.6
- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.62% on 20-09-2026
20-09-202620-10-2026
EPSS score0.62%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
- anywhere elementor≥ 1.2.5, < 1.2.8
Wordpress1 product
- anywhere-elementor≤ 1.2.7 (fixed in 1.2.8)
Wpvibes1 product
- anywhere_elementor< 1.2.8
3 vendors · 3 products