Risk Profile
8.8
CVSS Score
Vulnerability Report
Plugin
High
Patch path listed
CVE-2022-1329
Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
Quick Answer
CVE-2022-1329 is a high severity with CVSS 8.8 Remote Code Execution issue affecting the Plugin Elementor Website Builder – more than just a page builder. It affects 3.6.0 through 3.6.2 and is fixed in 3.6.3.
Published
Apr 13, 2022
Last Updated
Jan 22, 2024
Slug
elementor
Patch Status
Patched release is available
Remediation
Update to version 3.6.3, or a newer patched version
Operator Briefing
CVE-2022-1329 is tracked for the Plugin Elementor Website Builder – more than just a page builder as high severity with CVSS 8.8. The affected range is 3.6.0 through 3.6.2. Update Elementor Website Builder – more than just a page builder to 3.6.3 or newer where that version is compatible with the site.
Issue Type
Remote Code Execution
Primary Fixed Version
3.6.3
Primary Affected Range
3.6.0 through 3.6.2
Tracking ID
CVE-2022-1329
Detailed Metadata
| Software Type | Plugin |
|---|---|
| Software Slug |
elementor
View on wordpress.org
|
| CVE | CVE-2022-1329 |
| Patched Versions |
3.6.3
|
| Affected Versions |
3.6.0 through 3.6.2
|
Related CVE Cluster
Related CVEs for Elementor Website Builder – more than just a page builder
These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.
High
CVE-2024-24934
3.19.1
Feb 07, 2024
CVE-2024-24934 Elementor Website Builder – more than just a page builder Remote Code Execution
Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization
High
CVE-2023-48777
3.18.2
Dec 06, 2023
CVE-2023-48777 Elementor Website Builder – more than just a page builder Remote Code Execution
Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import
High
CVE-2020-7055
2.7.5
Oct 28, 2019
CVE-2020-7055 Elementor Website Builder – more than just a page builder Remote Code Execution
Elementor Website Builder <= 2.7.4 - Arbitrary File Upload
High
CVE-2017-18596
1.8.0
Nov 27, 2017
CVE-2017-18596 Elementor Website Builder – more than just a page builder Vulnerability
Elementor Website Builder <= 1.7.12 - Missing Authorization
High
CVE-2020-7109
2.8.4
Jan 19, 2020
CVE-2020-7109 Elementor Website Builder – more than just a page builder Cross-Site Scripting
Elementor Website Builder <= 2.8.3 - Cross-Site Scripting
Medium
CVE-2023-0329
3.12.2
Apr 24, 2023
CVE-2023-0329 Elementor Website Builder – more than just a page builder SQL Injection
Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'
Medium
CVE-2023-47504
3.16.5
Nov 08, 2023
CVE-2023-47504 Elementor Website Builder – more than just a page builder Vulnerability
Elementor Website Builder <= 3.16.4 - Missing Authorization to Arbitrary Attachment Read
Medium
CVE-2020-20634
2.9.6
Mar 31, 2020
CVE-2020-20634 Elementor Website Builder – more than just a page builder Authorization Bypass
Elementor Website Builder <= 2.9.5 - Authorization Bypass
Licensing Notices
This record contains material that is subject to copyright
DEFIANT
Copyright 2012-2026 Defiant Inc.
License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more
MITRE
Copyright 1999-2026 The MITRE Corporation
License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more