CVE-2023-0086 in JetWidgets for Elementor Plugin
Summary
by MITRE • 01/05/2023
The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be used to enable SVG uploads that could make Cross-Site Scripting possible.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The JetWidgets for Elementor plugin represents a popular extension for WordPress that enhances the functionality of the Elementor page builder with additional widgets and features. This particular vulnerability affects versions up to and including 1.0.12, making it a significant security concern for WordPress sites that utilize this plugin. The vulnerability stems from a fundamental flaw in the plugin's security implementation where the save() function lacks proper nonce validation mechanisms that are essential for protecting against cross-site request forgery attacks. This represents a critical oversight in the plugin's development lifecycle and demonstrates the importance of implementing proper security controls even in seemingly minor functions.
The technical flaw manifests as the absence of nonce validation within the save() function, which is a core security mechanism designed to verify that requests originate from legitimate sources within the same session. Without this validation, malicious actors can construct forged requests that appear to come from authenticated users, specifically targeting the plugin's configuration settings. This vulnerability operates under the CWE-352 category, which specifically addresses cross-site request forgery issues where applications fail to validate the authenticity of requests. The attack vector requires social engineering to trick administrators into executing malicious requests, but once successful, it provides attackers with the ability to modify critical plugin configurations.
The operational impact of this vulnerability extends beyond simple configuration changes, as it can be leveraged to enable SVG upload capabilities within the plugin's settings. This particular modification creates a dangerous pathway for executing cross-site scripting attacks, as SVG files can contain embedded malicious code that executes when viewed in web browsers. The combination of these two vulnerabilities creates a particularly dangerous scenario where attackers can first modify plugin settings to allow dangerous file uploads and then execute malicious code through those uploads. This vulnerability aligns with ATT&CK technique T1566 which involves social engineering tactics to manipulate users into performing actions that compromise system security.
The attack scenario begins with an unauthenticated attacker crafting a malicious request that targets the vulnerable save() function, bypassing the normal authentication and authorization checks. The attacker must then employ social engineering techniques to convince a site administrator to perform an action that triggers this forged request, such as clicking on a malicious link or visiting a compromised website. Once executed, the forged request modifies the plugin's configuration to enable SVG uploads, which then provides a persistent vector for executing XSS attacks against other users who view pages containing these malicious SVG files. This vulnerability demonstrates the importance of implementing proper security controls in all functions that modify system settings, regardless of their perceived importance or complexity. Organizations should prioritize immediate patching of this vulnerability and implement additional monitoring to detect unauthorized configuration changes. The vulnerability also highlights the necessity of regular security audits and proper input validation practices to prevent similar issues in other plugin components.