{"cvss":9.9,"datePublished":"2020-05-17T00:00:00Z","dateUpdated":"2020-05-17T00:00:00Z","description":"An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.","dueDate":"","id":"CVE-2020-13126","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"elementor_page_builder","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"elementor elementor_page_builder Unrestricted Upload of File with Dangerous Type","vendor":"elementor"}