CVE-2022-1329

What it actually does

Elementor Website Builder for WordPress versions 3.6.0 through 3.6.2 expose onboarding-related AJAX actions without proper capability checks. An authenticated low-privilege WordPress user can invoke actions intended only for administrators, allowing site data modification and upload/installation of attacker-controlled files. In the most serious case, an attacker can upload a malicious plugin archive or PHP payload and then execute it through the web server, resulting in remote code execution in the context of the WordPress/PHP application user.

Why it matters to the business

A vulnerable WordPress site can be taken over by anyone who can obtain or create a low-privilege account, which is especially risky for sites with public registration, memberships, e-commerce customers, contributors, or compromised user credentials. Successful exploitation can lead to defacement, malware distribution, data theft, credential harvesting, spam/SEO abuse, payment-page manipulation, and full operational disruption of the affected website. Although this issue is not listed in CISA KEV, it has a very high EPSS score and weaponized exploit maturity, so exposed vulnerable sites should be treated as high-priority remediation targets.

How an attack unfolds

An attacker first obtains authenticated access to the WordPress site, typically as a subscriber, customer, contributor, or any other low-privilege role. They then send crafted POST requests to WordPress admin-ajax.php targeting Elementor onboarding AJAX actions that lack an adequate authorization check. The most impactful path is abusing the Elementor Pro upload/install onboarding action to submit a ZIP archive that contains attacker-controlled PHP code packaged as a plugin. WordPress processes the request as though it came from an administrator, installs or places the uploaded content under the plugin directory, and may activate or make the code web-accessible. The attacker then browses directly to the malicious PHP file or uses the installed plugin functionality to execute commands, establish a web shell, create persistence, modify site content, steal configuration secrets, or pivot to the underlying hosting account and database.

How to fix it

Upgrade Elementor Website Builder immediately to a fixed supported version. Sites running 3.6.0, 3.6.1, or 3.6.2 should be upgraded to Elementor 3.6.3 or later; preferably upgrade to the latest available Elementor release from the official WordPress plugin repository. Remove any untrusted or unexpected plugins, themes, PHP files, and administrator accounts created during the exposure window. If immediate upgrade is not possible, temporarily disable Elementor, restrict access to /wp-admin/admin-ajax.php where operationally feasible, disable public user registration unless required, enforce strong authentication for all WordPress accounts, and limit low-privilege account creation. Mitigations should be considered temporary because the vulnerable authorization logic remains present until the plugin is updated.

How to confirm the fix worked

Confirm the installed Elementor version from the WordPress admin plugins page, wp plugin list if WP-CLI is available, or by inspecting wp-content/plugins/elementor/readme.txt and plugin metadata. The site should not report Elementor 3.6.0, 3.6.1, or 3.6.2. In a non-production or controlled test, authenticate as a subscriber-level user and attempt to invoke the affected Elementor onboarding AJAX upload/install action; a fixed installation should return an authorization failure and must not upload, install, activate, or modify plugin content. Also verify filesystem integrity by reviewing wp-content/plugins and wp-content/uploads for unexpected PHP files or recently created plugin directories around the vulnerable exposure period.

Typical attack path

1. Identify a WordPress site running Elementor Website Builder 3.6.0, 3.6.1, or 3.6.2.
2. Obtain or register a low-privilege WordPress account, or use stolen credentials for an existing low-privilege user.
3. Send crafted authenticated requests to /wp-admin/admin-ajax.php invoking vulnerable Elementor onboarding AJAX actions.
4. Upload a malicious plugin ZIP or PHP payload through the unauthorized Elementor upload/install action.
5. Trigger the uploaded PHP code over HTTP or through WordPress plugin execution.
6. Use the resulting code execution to create persistence, steal wp-config.php secrets, modify content, deploy web shells, or add unauthorized administrator accounts.

How to detect it

To determine whether exploitation already occurred, review web server access logs, reverse proxy logs, CDN/WAF events, WordPress audit logs, and hosting file modification records. Focus on authenticated POST requests to /wp-admin/admin-ajax.php containing Elementor onboarding action names, particularly elementor_upload_and_install_pro, from users or IP addresses that should not have administrative privileges. Correlate those requests with new or modified files under wp-content/plugins, wp-content/uploads, wp-content/mu-plugins, and active theme directories. Review WordPress administrative events for unexpected plugin installation, plugin activation, site name changes, new administrator users, modified users, new scheduled tasks, or changed options. On disk, look for PHP files with recent timestamps, obfuscated code such as eval/base64_decode/gzinflate/str_rot13, web shell parameters, or plugin directories that do not match known installed business plugins. If command execution is suspected, examine PHP-FPM, Apache/Nginx, system auth, process accounting, and outbound network logs for unusual child processes spawned by the web server user, outbound connections, or downloads of secondary payloads.

• action=elementor_upload_and_install_pro
• elementor_upload_and_install_pro
• /wp-admin/admin-ajax.php
• POST /wp-admin/admin-ajax.php
• wp-content/plugins/elementor/
• wp-content/plugins/elementor-pro/
• wp-content/mu-plugins/
• wp-content/uploads/elementor/
• base64_decode(
• gzinflate(
• shell_exec(
• passthru(
• eval($_POST
• eval($_REQUEST
• FilesMan
• WSOsetcookie
• /core/app/modules/onboarding/module.php

What your security team should do

• Prioritize patching all WordPress sites with Elementor 3.6.0 through 3.6.2 because exploit code is weaponized and the EPSS likelihood is very high.
• Upgrade Elementor to 3.6.3 or later, ideally the latest supported release, and confirm automatic plugin updates are enabled where appropriate.
• Inventory WordPress sites that allow public registration, customer accounts, memberships, or contributor access; treat these as the highest-risk exposure group.
• Review web, WordPress, WAF, and hosting logs for authenticated POST requests to admin-ajax.php invoking Elementor onboarding actions, especially from low-privilege users.
• Hunt for newly added plugins, unexpected PHP files, unknown administrator accounts, modified theme/plugin files, and suspicious WordPress cron jobs created after Elementor 3.6.0 was installed.
• Rotate WordPress administrator passwords, hosting/SFTP credentials, database credentials, and salts if evidence of code execution or web shell deployment is found.
• Disable or remove unused WordPress accounts and enforce MFA for privileged WordPress users where supported.