On February 2, 2022, Dark Reading reported an unauthenticated remote-code-execution risk in Essential Addons for Elementor, a WordPress plugin. The report identified versions 5.0.4 and earlier as affected, but described exploitation as conditional: the relevant plugin widgets and functions had to be present. Its installation and exposure figures are historical estimates, not current counts.
What is Essential Addons for Elementor?
Essential Addons for Elementor is a plugin for WordPress sites that use Elementor, a page builder. It adds page customizations and widgets. The reported issue was in Essential Addons, not a general flaw in every Elementor installation.
Which versions did the report identify as vulnerable?
Dark Reading’s February 2, 2022 report identified Essential Addons for Elementor versions 5.0.4 and earlier as affected. It said the developer first issued an update, but Patchstack found that patch defective and reported the problem. A further update was released on January 28, 2022 and was described in the report as fixing the flaw. The report did not name that corrected release’s version number, so it does not establish which version number site operators should verify today. Dark Reading’s report
How could the flaw lead to remote code execution?
The report characterized the vulnerability as local file inclusion (LFI). In an LFI weakness, an application may treat a user-supplied file path as trusted input and include a local file. If an attacker can make the application include a file containing malicious PHP, that code may run on the server, creating a route to remote code execution.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
Pravin Madhani, CEO and co-founder of K2 Cyber Security, told Dark Reading: “Typically, LFI occurs when an application uses the path to a file as input,” and “If the application treats this input as trusted, a local file may be used in the include statement.”
Did exploitation require an account?
No. Dark Reading described the attack as unauthenticated, meaning an attacker did not need to log in to the WordPress site. However, the report said the issue manifested only when widgets using the vulnerable plugin functions were present. Having the plugin installed alone should not be treated as proof that every site was exploitable under all conditions.
What did “tens of thousands” mean?
At the time of its February 2022 report, Dark Reading said the plugin had more than one million installations and estimated that potentially tens or even hundreds of thousands of WordPress sites could be vulnerable. Those figures were estimates tied to that publication date. They do not show how many sites use the plugin now, how many were exposed then, or how many remain unpatched.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should WordPress site operators do?
- Update the plugin and WordPress. Keep WordPress and its plugins patched. Because the report does not state the corrected plugin version and does not establish present-day plugin status, check the current official release information before relying on a version number.
- Remove plugins you do not use. Unused plugins add software that still needs monitoring and maintenance.
- Use layered defenses. Madhani recommended security at the edge, runtime, and server layers, including web application firewalls, runtime application security controls, and endpoint detection and response. These are general defenses, not substitutes for installing a vendor fix.
- Maintain account and incident safeguards. Madhani advised monitoring incident reports from security tools, using strong password rules, and enabling multifactor authentication (MFA) for WordPress accounts.
These steps reduce avoidable exposure and improve detection, but the report does not claim that any single security control alone remedies the plugin flaw.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
