ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite

This research plan outlines the steps required to demonstrate the Missing Authorization vulnerability in the ElementsKit Elementor Addons plugin (CVE-2026-4362).

1. Vulnerability Summary

The ElementsKit Elementor Addons plugin (specifically the Lite version up to 3.8.2) contains a flaw in its Live_Action::reset() function. This function is designed to reset the Elementor layout data for custom widget templates. However, the function is hooked to the global init action and executes based on the presence of common GET parameters (post and action=elementor) without verifying the user's identity or checking for a security nonce. This allows an unauthenticated attacker to permanently delete the layout configuration (_elementor_data) of any post of the type elementskit_widget, effectively breaking the custom widget designs.

2. Attack Vector Analysis

• Endpoint: The root site URL (the function is hooked to init).
• Target Hook: init
• Vulnerable Function: ElementsKit_Lite\Modules\Widget_Builder\Live_Action::reset (inferred module path based on post type).
• Parameters:
  • post (GET): The ID of the elementskit_widget to target.
  • action (GET): Must be set to elementor.
• Authentication: None (Unauthenticated).
• Preconditions: An elementskit_widget custom post type must exist on the site.

3. Code Flow

1. During WordPress initialization, ElementsKit_Lite\Core\Build_Modules (see core/build-modules.php) loads active modules.
2. The Widget_Builder module (part of ElementsKit) initializes the Live_Action class.
3. The Live_Action constructor registers a callback to the init hook.
4. The init callback checks for the presence of $_GET['post'] and $_GET['action'] == 'elementor'.
5. If these are present, it calls reset($_GET['post']).
6. The reset() function uses update_post_meta($post_id, '_elementor_data', '') (or a similar empty JSON string) to clear the layout data without any current_user_can() check or wp_verify_nonce() check.

4. Nonce Acquisition Strategy

Based on the vulnerability description, no nonce is required. The vulnerability exists precisely because the init hook processes these parameters globally before any authentication or nonce verification occurs in the vulnerable code path.

5. Exploitation Strategy

1. Discovery: Enumerate the site for existing elementskit_widget IDs. These are often used for custom header/footer elements or custom widgets.
2. Verification of Target: Check if the post ID corresponds to an elementskit_widget type.
3. The Attack: Send a simple unauthenticated GET request to the WordPress index with the specifically crafted parameters.

HTTP Request Payload:

GET /?post=[TARGET_POST_ID]&action=elementor HTTP/1.1
Host: [TARGET_HOST]
Connection: close

Note: While action=elementor is also used by the legitimate Elementor editor, the ElementsKit hook triggers earlier or alongside it, and because it lacks auth checks, it clears the data before the user is even redirected to a login page.

6. Test Data Setup

To verify the exploit, the following environment must be prepared:

1. Activate Plugin: Ensure elementskit-lite version 3.8.2 is installed and active.
2. Create Content: Use WP-CLI to create a dummy elementskit_widget.

   # Create the widget post
   WIDGET_ID=$(wp post create --post_type=elementskit_widget --post_title="Vulnerable Widget" --post_status=publish --porcelain)
   
   # Add dummy Elementor data to simulate a complex design
   wp post meta update $WIDGET_ID _elementor_data '[{"id":"1","elType":"section","settings":{},"elements":[{"id":"2","elType":"column","settings":{"_column_size":100},"elements":[{"id":"3","elType":"widget","settings":{"title":"Hello World"},"widgetType":"heading"}]}]}]'
   

7. Expected Results

• HTTP Response: The server may return a 200 OK or a redirect to a login page (if Elementor core also attempts to handle the action=elementor).
• Database Impact: Regardless of the HTTP response status, the metadata _elementor_data for the targeted post ID will be overwritten with an empty value or a blank Elementor template structure.

8. Verification Steps

After sending the HTTP request, verify the damage using WP-CLI:

# Check if the _elementor_data meta key is empty or changed
wp post meta get [WIDGET_ID] _elementor_data

Success Condition: The output of the get command is empty or significantly different from the "Hello World" JSON payload injected during setup.

9. Alternative Approaches

If the action=elementor check is insufficient (e.g., if the plugin requires a specific ekit-specific parameter in some sub-versions), check for a hidden "ekit_action" parameter:

• Alternative URL: /?post=[ID]&action=elementor&ekit_action=reset (inferred from common plugin reset patterns).
• Alternative Post Type: While the description focuses on elementskit_widget, this logic might also impact header_footer_builder post types if they share the same reset logic module.