The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass
Priority MEDIUM 59CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
Why it matters now
EPSS 0.17177 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed The Plus Addons for Elementor Page Builder (Unknown): 4.1.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | The Plus Addons for Elementor Page Builder | 4.1.7 to before 4.1.7 | 4.1.7 | Patch available | CNA |
- The Plus Addons for Elementor Page Builder VendorUnknown Affected 4.1.7 to before 4.1.7 Fixed in 4.1.7 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:*:wordpress:*:* | before 4.1.7 | Vulnerable | posimyththemes |
- cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:*:wordpress:*:* Versions before 4.1.7 Vulnerable ·posimyththemes
Remediation
- Fix · CNA The Plus Addons for Elementor Page Builder (Unknown) Fixed in 4.1.7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24175
- 2026-10-03 Alias added: GHSA-fpx3-pcr2-8rvr
References
More posimyththemes The Plus Addons For Elementor vulnerabilities
- TI-2023-25501 WordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.8
- TI-2021-07228 The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2021-03189 Missing authorization in posimyththemes The Plus Addons for Elementor – Addons for… CVSS 3.1HIGH 8.8
- TI-2024-05069 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu… CVSS 3.1HIGH 8.8
- TI-2024-29521 WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2024-02046 The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients Widget CVSS 3.1HIGH 8.8
Sources
- CVE-2021-24175 · CVE Program
- CVE-2021-24175 · NVD
- FIRST EPSS
- GHSA-fpx3-pcr2-8rvr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences