Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2022-1329 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Elementor Website Builder. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The Elementor Website Builder plugin for WordPress contains a missing capability check in the onboarding module at core/app/modules/onboarding/module.php. This flaw affects versions 3.6.0 through 3.6.2 and permits unauthorized execution of multiple AJAX actions. The issue is tracked under CWE-862 and CWE-434 and carries a CVSS 3.1 score of 8.8.
An authenticated attacker with low-privileged WordPress access can invoke the unprotected AJAX endpoints to alter site configuration and upload arbitrary files. Successful exploitation yields remote code execution on the underlying web server.
Public advisories and the vendor patchset at plugins.trac.wordpress.org/changeset/2708766 recommend immediate upgrade beyond version 3.6.2. Wordfence and Plugin Vulnerabilities both published technical write-ups confirming that the capability checks were added in the subsequent release to block the affected onboarding routes.
PacketStorm has published working exploit code demonstrating unauthenticated-to-RCE chains against the vulnerable plugin, and the CVE maintains an EPSS score above 0.93, indicating sustained exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-24657
Vulnerability Data
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading…
more
malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization checks on AJAX actions, blocking the missing capability check that allows low-privileged users to invoke onboarding endpoints.
Ensures low-privileged WordPress accounts cannot execute file-upload or configuration-change functions outside their assigned role, stopping the unauthorized RCE path.
Restricts which authenticated principals may perform site-modifying operations, limiting the impact of the unprotected onboarding AJAX routes.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicitly requires defining, enforcing, and reviewing authorizations and least privilege, directly preventing missing authorization checks.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
Hardened configuration baselines can enforce allowed file types and processing rules.
Secure development practices include input validation and file-type restrictions that prevent this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Configuration and acceptance testing verify that file-upload handling enforces allowed types and does not permit dangerous content to be stored or executed.
Requiring authentication and credentials before any access occurs eliminates the absence of authorization checks that would otherwise allow an unauthenticated actor to reach protected resources.
Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.
Mandatory authorization checks and central records of granted rights ensure that every access attempt is preceded by an explicit decision rather than relying on missing checks.
Segregating the approval of access rights from their implementation provides an independent check that reduces the impact of missing authorization checks in the resulting system configuration.
By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.