Vulnerability Description
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Brainstormforce | Ultimate Addons For Elementor | < 1.24.2 |
References
- https://wpvulndb.com/vulnerabilities/10214Not Applicable
- https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultiThird Party Advisory
- https://wpvulndb.com/vulnerabilities/10214Not Applicable
- https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultiThird Party Advisory
FAQ
What is CVE-2020-13125?
CVE-2020-13125 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers ca...
How severe is CVE-2020-13125?
CVE-2020-13125 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-13125?
Check the references section above for vendor advisories and patch information. Affected products include: Brainstormforce Ultimate Addons For Elementor.