{"id":1029,"date":"2021-03-09T11:02:53","date_gmt":"2021-03-09T03:02:53","guid":{"rendered":"https:\/\/blog.ebuildhost.com\/?p=1029"},"modified":"2021-03-09T11:02:53","modified_gmt":"2021-03-09T03:02:53","slug":"the-plus-addons-for-elementor-%e5%ad%98%e5%9c%a8critical-zero-day%e6%bc%8f%e6%b4%9e-%e8%83%bd%e4%bb%a5%e7%ae%a1%e7%90%86%e5%93%a1%e6%b3%a8%e5%86%8a%e5%8f%8a%e7%99%bb%e9%99%b8","status":"publish","type":"post","link":"https:\/\/ebuildhost.com\/hk\/blog\/webdesign-and-development\/wordpress\/elementor\/1029\/","title":{"rendered":"The Plus Addons for Elementor \u5b58\u5728Critical zero-day\u6f0f\u6d1e: \u80fd\u4ee5\u7ba1\u7406\u54e1\u6ce8\u518a\u53ca\u767b\u9678"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">2021\u5e743\u67088\u65e5\uff0cWordfence\u5a01\u8105\u60c5\u5831\u5718\u968a\u610f\u8b58\u5230Elementor\u7684The Plus Addons\u4e2d\u5b58\u5728&#8221;critical zero-day \u96f6\u65e5\u6f0f\u6d1e\u6216\u96f6\u6642\u5dee\u6f0f\u6d1e&#8221;\u901a\u5e38\u662f\u6307\u9084\u6c92\u6709\u4fee\u88dc\u7a0b\u5f0f\u7684\u5b89\u5168\u6f0f\u6d1e\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8a72\u63d2\u4ef6\u662f\u4e00\u500b\u9ad8\u7d1a\u4ed8\u6b3e\u63d2\u4ef6\uff0cWordfence\u4f30\u8a08\u6709\u8d85\u904e3\u842c\u500b\u5b89\u88dd\u91cf\u30023\u67088\u65e5\u65e9\u4e0a\uff0c\u5bc4\u5b58\u516c\u53f8Seravo\u5411WPScan\u5831\u544a\u4e86\u9019\u500b\u6f0f\u6d1e\u3002\u8a72\u6f0f\u6d1e\u4f7f\u5f97\u653b\u64ca\u8005\u6709\u53ef\u80fd\u5728\u6613\u53d7\u653b\u64ca\u7684\u7db2\u7ad9\u4e0a\u5275\u5efa\u65b0\u7684\u7ba1\u7406\u54e1\u8cec\u6236\uff0c\u5982\u679c\u7528\u6236\u8a3b\u518a\u88ab\u555f\u7528\uff0c\u540c\u6642\u4ee5\u5176\u4ed6\u7ba1\u7406\u54e1\u8eab\u4efd\u767b\u9304\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Plus Addons for Elementor Lite\uff0c\u5373\u540c\u4e00\u958b\u767c\u5546\u7684\u514d\u8cbb\u7248\u672c\uff0c\u53cd\u800c\u4e26\u6c92\u6709\u53d7\u5230\u9019\u500b\u6f0f\u6d1e\u7684\u5f71\u97ff\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Wordfence Premium\u5ba2\u6236\u57282021\u5e743\u67088\u65e5\u6536\u5230\u4e86\u4e00\u500b\u898f\u5247\uff0c\u4ee5\u9632\u6b62\u4e3b\u52d5\u5229\u7528\u9019\u500b\u6f0f\u6d1e\u3002\u4ecd\u5728\u4f7f\u7528\u514d\u8cbb\u7248\u7684Wordfence\u7528\u6236\u5c07\u57282021\u5e744\u67087\u65e5\u6536\u5230\u4fdd\u8b77\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5982\u679c\u60a8\u6b63\u5728\u4f7f\u7528The Plus Addons for Elementor\u63d2\u4ef6\uff0cWordfence\u5f37\u70c8\u5efa\u8b70\u60a8\u5b8c\u5168\u505c\u7528\u4e26\u522a\u9664\u8a72\u63d2\u4ef6\uff0c\u76f4\u5230\u8a72\u6f0f\u6d1e\u88ab\u4fee\u88dc\u3002\u514d\u8cbb\u7248\u672c\u5982\u80fd\u5920\u6eff\u8db3\u60a8\u7684\u9700\u6c42\uff0c\u60a8\u53ef\u4ee5\u66ab\u6642\u5207\u63db\u5230\u8a72\u7248\u672c\u3002\u5982\u679c\u60a8\u7684\u7db2\u7ad9\u529f\u80fd\u4f9d\u8cf4\u65bc\u6b64\u63d2\u4ef6\uff0c\u6211\u5011\u5efa\u8b70\u5b8c\u5168\u522a\u9664\u63d2\u4ef6\u6dfb\u52a0\u7684\u4efb\u4f55\u8a3b\u518a\u6216\u767b\u9304\u5c0f\u5de5\u5177\uff0c\u4e26\u7981\u7528\u60a8\u7db2\u7ad9\u4e0a\u7684\u8a3b\u518a\u3002\u5728\u6b64\u767c\u5e03\u4e4b\u6642\uff0c\u9084\u6c92\u6709\u6253\u904e\u88dc\u4e01\u7684\u7248\u672c\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Description: Privilege Escalation<br>Affected Plugin: The Plus Addons for Elementor<br>Plugin Slug: theplus_elementor_addon<br>Affected Versions: &lt;= 4.1.5<br>CVE ID: 2021-24175<br>CVSS Score: 9.8 (Critical)<br>CVSS Vector: CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H<br>Fully Patched Version: Currently unpatched.<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;The Plus Addons for Elementor &#8220;\u662f\u4e00\u500b\u63d2\u4ef6\uff0c\u65e8\u5728\u6dfb\u52a0\u5e7e\u500b\u984d\u5916\u7684\u5c0f\u90e8\u4ef6\u4f9bElementor\u4f7f\u7528\u3002\u5176\u4e2d\u4e00\u500b\u5c0f\u90e8\u4ef6\u589e\u52a0\u4e86\u5411Elementor\u9801\u9762\u6dfb\u52a0\u7528\u6236\u767b\u9304\u548c\u8a3b\u518a\u8868\u683c\u7684\u529f\u80fd\u3002\u4e0d\u5e78\u7684\u662f\uff0c\u9019\u500b\u529f\u80fd\u914d\u7f6e\u4e0d\u7576\uff0c\u5141\u8a31\u653b\u64ca\u8005\u4f5c\u70ba\u7ba1\u7406\u54e1\u8a3b\u518a\uff0c\u6216\u4f5c\u70ba\u73fe\u6709\u7684\u7ba1\u7406\u54e1\u767b\u9304\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u5373\u4f7f\u4f60\u6c92\u6709\u4f7f\u7528\u8a72\u63d2\u4ef6\u5275\u5efa\u7684\u6d3b\u52d5\u767b\u9304\u6216\u8a3b\u518a\u9801\u9762\uff0c\u9019\u500b\u6f0f\u6d1e\u4ecd\u7136\u53ef\u4ee5\u88ab\u5229\u7528\u3002\u9019\u610f\u5473\u8457\uff0c\u4efb\u4f55\u904b\u884c\u8a72\u63d2\u4ef6\u7684\u7db2\u7ad9\u90fd\u5bb9\u6613\u88ab\u5165\u4fb5\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u76ee\u524d\uff0c\u7531\u65bc\u9019\u662f\u4e00\u500b\u88ab\u7a4d\u6975\u5229\u7528\u7684\u6f0f\u6d1e\uff0cWordfence\u767c\u5e03\u7684\u7d30\u7bc0\u975e\u5e38\u5c11\u3002\u6211\u5011\u53ef\u80fd\u6703\u5728\u672a\u4f86\u6c7a\u5b9a\u767c\u5e03\u66f4\u591a\u7684\u7d30\u7bc0\uff0c\u4f46\u8207\u6b64\u540c\u6642\uff0c\u6211\u5011\u5efa\u8b70\u4f60\u63a1\u53d6\u9069\u7576\u7684\u63aa\u65bd\u4f86\u4fdd\u8b77\u4f60\u7684\u7db2\u7ad9\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u6f0f\u6d1e\u7684\u6307\u6a19<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u76ee\u524d\uff0cWordfence\u638c\u63e1\u7684\u6d29\u5bc6\u8de1\u8c61\u975e\u5e38\u6709\u9650\u3002\u7136\u800c\uff0cWordfence\u8a8d\u70ba\u653b\u64ca\u8005\u6b63\u5728\u6839\u64da\u8a72\u6f0f\u6d1e\u5982\u4f55\u5275\u5efa\u7528\u6236\u8cec\u6236\u7684\u65b9\u5f0f\u6dfb\u52a0\u7528\u6236\u540d\u4f5c\u70ba\u8a3b\u518a\u7684\u96fb\u5b50\u90f5\u4ef6\u5730\u5740\uff0c\u4e26\u5728\u67d0\u4e9b\u60c5\u6cc1\u4e0b\u5b89\u88dd\u4e86\u6a19\u6709<strong>wpstaff<\/strong>\u7684\u60e1\u610f\u63d2\u4ef6\u3002\u6211\u5011\u5f37\u70c8\u5efa\u8b70\u6aa2\u67e5\u60a8\u7684\u7db2\u7ad9\u662f\u5426\u6709\u4efb\u4f55\u4e0d\u8a8d\u8b58\u7684\u7ba1\u7406\u54e1\u6216\u60a8\u6c92\u6709\u5b89\u88dd\u7684\u63d2\u4ef6\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Wordfence\u53caEBuildHost\u5c07\u5728\u4e86\u89e3\u66f4\u591a\u4fe1\u606f\u5f8c\u66f4\u65b0\u672c\u7bc7\u6587\u7ae0\u5167\u5bb9\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Wordfence \u61c9\u5c0d\u6642\u9593\u8868<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>March 8th, 2021 8:55 AM UTC \u2013 New vulnerability entry in WPScan reporting 0-day vulnerability in the The Plus Addons for Elementor plugin.<br>March 8th, 2021 1:32 PM UTC \u2013 Wordfence Threat Intelligence is alerted to the new vulnerability report and begins to triage the vulnerability.<br>March 8th, 2021 2:08 PM UTC \u2013 We verify the existence of the vulnerability and create a proof of concept.<br>March 8th, 2021 2:20 PM UTC \u2013 We create and begin testing a firewall rule to protect against the vulnerability.<br>March 8th, 2021 2:25 PM UTC \u2013 We reach out to the plugin developer to make sure that they are aware of the vulnerability and offer to provide details if required.<br>March 8th, 2021 2:50 PM UTC \u2013 The firewall rule is deployed to premium users.<br>April 7th, 2021 \u2013 Wordfence Free users receive the firewall rule.<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u7d50\u8ad6<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728\u4eca\u5929\u7684\u5e16\u5b50\u4e2d\uff0c\u6211\u5011\u8a73\u7d30\u4ecb\u7d39\u4e86The Plus Addons for Elementor\u5c1a\u672a\u4fee\u88dc\u7684\u5b89\u5168\u6f0f\u6d1e\uff0c\u8a72\u63d2\u4ef6\u53ef\u8b93\u672a\u7d93\u8eab\u4efd\u9a57\u8b49\u7684\u653b\u64ca\u8005\u63d0\u5347\u5176\u5728\u6613\u53d7\u653b\u64ca\u7684WordPress\u6ce8\u518a\u7ba1\u7406\u54e1\u6b0a\u9650\u3002\u9019\u53ef\u4ee5\u4ee4\u60a8\u7684WordPress\u7db2\u7ad9\u88ab\u5b8c\u5168\u63a5\u7ba1\u6216\u7834\u58de\u3002\u622a\u81f3\u4eca\u5929\u65e9\u4e0a\uff0c\u6b64\u6f0f\u6d1e\u7576\u524d\u4ecd\u672a\u4fee\u5fa9\uff0c\u56e0\u6b64\uff0c<strong>\u6211\u5011\u5f37\u70c8\u5efa\u8b70\u60a8\u505c\u7528\u4e26\u522a\u9664\u8a72\u63d2\u4ef6\uff0c\u76f4\u5230\u767c\u5e03\u88dc\u4e01\u70ba\u6b62\u3002<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u7576Wordfence\u6709\u65b0\u4e00\u6b65\u9032\u5c55\u6211\u5011\u4ea6\u6703\u76e1\u5feb\u66f4\u65b0\u90e8\u843d\u683c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u539f\u59cb\u8cc7\u6599\uff1a<a href=\"https:\/\/www.wordfence.com\/blog\/2021\/03\/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.wordfence.com\/blog\/2021\/03\/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>2021\u5e743\u67088\u65e5\uff0cWordfence\u5a01\u8105\u60c5\u5831\u5718\u968a\u610f\u8b58\u5230Elementor\u7684The Plus Addons\u4e2d\u5b58 [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":3797,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[85,75,80,76],"tags":[],"class_list":["post-1029","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-elementor","category-wordpress","category-website-security","category-webdesign-and-development"],"_links":{"self":[{"href":"https:\/\/ebuildhost.com\/hk\/wp-json\/wp\/v2\/posts\/1029","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ebuildhost.com\/hk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ebuildhost.com\/hk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ebuildhost.com\/hk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ebuildhost.com\/hk\/wp-json\/wp\/v2\/comments?post=1029"}],"version-history":[{"count":0,"href":"https:\/\/ebuildhost.com\/hk\/wp-json\/wp\/v2\/posts\/1029\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ebuildhost.com\/hk\/wp-json\/wp\/v2\/media\/3797"}],"wp:attachment":[{"href":"https:\/\/ebuildhost.com\/hk\/wp-json\/wp\/v2\/media?parent=1029"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ebuildhost.com\/hk\/wp-json\/wp\/v2\/categories?post=1029"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ebuildhost.com\/hk\/wp-json\/wp\/v2\/tags?post=1029"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}