Not Really a WordPress Plugin Vulnerability, Week of April 28
In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.
Authenticated (Administrator+) SQL Injection via ‘replace_urls’ in Elementor
Yesterday, we issued an advisory warning about using plugins developed by Elementor, in part based on a security issue we found still is in the plugin. We found that while reviewing a security change being made in the latest version of the plugin. Wordfence claimed that the change fixed a vulnerability:
The Elementor plugin for WordPress is vulnerable to blind SQL Injection via the ‘replace_urls’ functionality in versions up to, and including, 3.12.1 due to insufficient escaping on the user supplied ‘old’ and ‘new’ parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Wordfence doesn’t provide basic information needed to confirm their claim or even specify what the “administrator-level permissions” are supposed to be for that. What they seem to be referring to is that a valid nonce is needed and that is only accessible to users with the manage_options capability, which only Administrators have. If an attacker is logged in as an Administrator then they can already do what is mentioned here, since they are an Administrator. So that isn’t a vulnerability. They failed to note the still present security issue.
Despite the lack of information needed to verify Wordfence’s claim there, Patchstack, which claims to verify vulnerabilities before adding them to their data set (but doesn’t actually do that), copied Wordfence’s information. Unsurprisingly, they failed to note the unaddressed security issue either.
Plugin Security Scorecard Grade for Elementor
Checked on June 30, 2025See issues causing the plugin to get less than A+ grade