CVE-2023-48777

Elementor Website Builder between 3.3.0 and 3.18.1 allows unrestricted upload of a dangerous file type. An attacker with a low-privileged authenticated foothold can upload a file the server will execute — the classic route to a web shell and, from there, control of the WordPress site: its content, its database, and a launch point into the hosting environment. The 9.9 reflects how little stands between that foothold and full compromise.

What makes this one urgent is scale as much as severity. Elementor is one of the most widely installed WordPress builders in existence, so the vulnerable version window covers an enormous population of sites, and any authenticated file-upload path to code execution on a plugin that ubiquitous is exactly what mass-scanning campaigns invest in. The low-privilege requirement is a soft gate: contributor- and subscriber-level accounts are cheap to obtain on sites with open registration.

The plugin's very popularity is the trap — it's installed per-site, often by owners who don't track versions centrally, so the scary headline only becomes a plan once we answer where it runs, at what version, and whether registration is open. Our job is to collapse that huge nominal footprint into a ranked list: vulnerable-version Elementor installs that also allow low-privilege account creation are the ones we push to the front.