Elementor Issues Second Fix for Authenticated Arbitrary File Upload Vulnerability

Yesterday, we covered a security fix issued for the 5+ million install WordPress plugin Elementor for authenticated arbitrary file upload vulnerability. That happened in version 3.18.1. Today, a second fix was released in the next version, 3.18.2. The changelog acknowledges that, “Security Fix: Addressed security weaknesses in template upload mechanism.” The new fix addresses a significant limitation of the first fix and, as far as we are aware, should fully resolve this.

The first fix restricted the ability for an attacker logged in to WordPress as a user with the Contributor role or above, to use directory traversal to move a file uploaded to outside of the intended directory for it, which has randomized name. That would restrict the attacker from at least easily accessing the file. It didn’t limit what types of files they could upload through the relevant code. The second fix puts in place that restriction.

The change this time was made in the function save_base64_to_tmp_file() in the file /core/files/uploads-manager.php. The new code added to the beginning of the function checks if the file being uploaded has allowed file extension:

private function save_base64_to_tmp_file( $file, $allowed_file_extensions = null ) {
	$file_extension = pathinfo( $file['fileName'], PATHINFO_EXTENSION );
	$is_file_type_allowed = $this-&gt;is_file_type_allowed( $file_extension, $allowed_file_extensions );
 
	if ( is_wp_error( $is_file_type_allowed ) ) {
		return $is_file_type_allowed;
	}