CVE-2024-11600

CVE-2024-11600 is a remote code execution vulnerability affecting the Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress, in all versions up to and including 1.6.0. The issue stems from a lack of sanitization on an imported JSON file in the 'write_config' function within the plugin's icon-manager component, classified under CWE-94 (Code Injection). It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.

Authenticated attackers with Administrator-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By crafting a malicious JSON file and importing it via the plugin's functionality, they can achieve arbitrary code execution on the affected WordPress server, potentially leading to full server compromise.

References from the WordPress plugin trac repository highlight vulnerable code locations in icon-manager.php at lines 249, 333, and 388 in version 1.5.7, along with a patch applied in changeset 3231327 to the trunk. Wordfence's threat intelligence advisory (ID 643b8b82-c4e1-4b81-a7e0-aee0f9270702) documents the issue, recommending updates to patched versions beyond 1.6.0 for mitigation.