{"id":"CVE-2023-32243","aliases":["EUVD-2023-36500","GHSA-4xm5-cg4q-prrp"],"status":"published","title":"WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation","description":"Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.75531,"percentile":0.99522,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2023-05-12T07:23:22Z","modified":"2026-06-17T05:58:23Z","exploits":[{"source":"nuclei","id":"CVE-2023-32243","title":"WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32243.yaml"},{"source":"pocgithub","id":"Jenderal92/WP-CVE-2023-32243","title":"Jenderal92/WP-CVE-2023-32243","date":"2023-07-03","url":"https://github.com/Jenderal92/WP-CVE-2023-32243"},{"source":"pocgithub","id":"RandomRobbieBF/CVE-2023-32243","title":"RandomRobbieBF/CVE-2023-32243","date":"2023-05-15","url":"https://github.com/RandomRobbieBF/CVE-2023-32243"},{"source":"pocgithub","id":"YouGina/CVE-2023-32243","title":"YouGina/CVE-2023-32243","date":"2023-05-24","url":"https://github.com/YouGina/CVE-2023-32243"},{"source":"pocgithub","id":"dev0558/CVE-2023-32243-Detection-and-Mitigation-in-WordPress","title":"dev0558/CVE-2023-32243-Detection-and-Mitigation-in-WordPress","date":"2025-04-29","url":"https://github.com/dev0558/CVE-2023-32243-Detection-and-Mitigation-in-WordPress"},{"source":"pocgithub","id":"gbrsh/CVE-2023-32243","title":"gbrsh/CVE-2023-32243","date":"2023-05-14","url":"https://github.com/gbrsh/CVE-2023-32243"},{"source":"pocgithub","id":"little44n1o/cve-2023-32243","title":"little44n1o/cve-2023-32243","date":"2023-05-13","url":"https://github.com/little44n1o/cve-2023-32243"},{"source":"pocgithub","id":"manavvedawala2/CVE-2023-32243-proof-of-concept","title":"manavvedawala2/CVE-2023-32243-proof-of-concept","date":"2023-05-23","url":"https://github.com/manavvedawala2/CVE-2023-32243-proof-of-concept"},{"source":"pocgithub","id":"thatonesecguy/Wordpress-Vulnerability-Identification-Scripts","title":"thatonesecguy/Wordpress-Vulnerability-Identification-Scripts","date":"2023-05-29","url":"https://github.com/thatonesecguy/Wordpress-Vulnerability-Identification-Scripts"}],"products":[{"vendor":"wpdeveloper","product":"essential addons for elementor"},{"vendor":"wpdeveloper","product":"essential_addons_for_elementor"}],"references":[{"url":"https://patchstack.com/database/vulnerability/essential-addons-for-elementor-lite/wordpress-essential-addons-for-elementor-plugin-5-4-0-5-7-1-unauthenticated-privilege-escalation-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://patchstack.com/articles/critical-privilege-escalation-in-essential-addons-for-elementor-plugin-affecting-1-million-sites?_s_id=cve","tags":["technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/172457/WordPress-Elementor-Lite-5.7.1-Arbitrary-Password-Reset.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32243"},{"url":"https://github.com/advisories/GHSA-4xm5-cg4q-prrp"}],"sources":{"cve":[{"id":"CVE-2023-32243","title":"WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation","description":"Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.","status":"published","published":"2023-05-12T07:23:22.657Z","modified":"2026-04-28T16:08:22.366Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:35:29.01154Z"}],"euvd":[{"id":"EUVD-2023-36500","description":"Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.","status":"published","published":"2023-05-12T07:23:22Z","modified":"2026-04-28T16:08:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:09.272661Z"}],"ghsa":[{"id":"GHSA-4xm5-cg4q-prrp","title":"Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows...","description":"Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.","status":"published","published":"2023-07-06T21:14:56Z","modified":"2024-04-04T05:42:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:56:34.916776Z"}],"nvd":[{"id":"CVE-2023-32243","description":"Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.","status":"published","published":"2023-05-12T08:15:09.28Z","modified":"2026-06-17T05:58:23.593Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:08:02.399327Z"}]}}