Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-53739: Cryptocurrency Widgets For Elementor can let attackers run code

CVE-2024-53739 · published 1 year ago

Summary

The Cryptocurrency Widgets for Elementor plugin can be tricked into loading unauthorized files, which lets a hacker execute their own code on your website. This could lead to data theft, site defacement, or further compromise of your system. Update the plugin to the latest version (beyond 1.6.4) or remove it if you do not need it.

What to do

Update coolplugins cryptocurrency_widgets_for_elementor to version 1.6.5 or later.

Affected software

Vendor	Product	Affected versions
coolplugins	cryptocurrency_widgets_for_elementor	< 1.6.5 `cpe:2.3:a:coolplugins:cryptocurrency_widgets_for_elementor::::::wordpress::*`

Original advisory text

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cool Plugins Cryptocurrency Widgets For Elementor cryptocurrency-widgets-for-elementor allows PHP Local File Inclusion.This issue affects Cryptocurrency Widgets For Elementor: from n/a through <= 1.6.4.

References

https://patchstack.com/database/wordpress/plugin/cryptocurrency-widgets-for-elem... Third Party Advisory
https://patchstack.com/database/Wordpress/Plugin/cryptocurrency-widgets-for-elem... Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-98Improper Control of Filename for Include

CWE-706Use of Incorrectly-Resolved Name or Reference

Timeline

Published30 Nov 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-53739 · NVD

Track software like this

Free during beta