According to BleepingComputer, Elementor Pro version 3.11.7 fixes a critical vulnerability that in combination with the WooCommerce plugin running on the site allows any authenticated user (such as the subscriber or customer user role) to update any WordPress setting on the site.
This is done through an AJAX action of Elementor.
This vulnerability is exploitable when using Elementor Pro versions prior to 3.11.7.
In addition to this, there have been other vulnerabilities found in WordPress plugins such as Essential Addons for Elementor and a remote code execution vulnerability in Elementor .
To protect your website from these vulnerabilities, it is important to keep your WordPress plugins up-to-date and use security plugins such as Wordfence or Sucuri. It is also important to use strong passwords and two-factor authentication.
In conclusion, it is important to stay vigilant and keep your website secure by keeping your plugins up-to-date and using security plugins. This will help prevent attackers from exploiting vulnerabilities and compromising your website’s security.
