Elementor Sites Hacked Due to Zero Day Vulnerability

DerangedWolf · Mar 11, 2021

I read this news: The Plus Addons for Elementor Critical Vulnerability

I didn't take it seriously. But then I checked my Facebook and Reddit, and people are actually reporting that their sites are injected with some codes.

Are you all safe?

satyr85 · Mar 11, 2021

Bloodseeker said:
I read this news: The Plus Addons for Elementor Critical Vulnerability

I didn't take it seriously. But then I checked my Facebook and Reddit, and people are actually reporting that their sites are injected with some codes.

Are you all safe?

Im safe, I dont use WP and elementor at all.

IM Dude · Mar 11, 2021

I am safe and my clients. I don't use that add-on.
I got that news on my google news feed yesterday.

anishsahelance · Mar 11, 2021

Yes my website too got injected with Japanese Keyword Virus. We successfully managed to remove all the malware but there are way too many spam pages indexed on Google.

Does anyone know how to remove these pages from Google index? We have tried using Google Search Console's "Removal feature" but when I try to submit a removal request for any of these spammy pages, GSC says, "URL not in property".

Any other solution?

DerangedWolf · Mar 11, 2021

IM Rider said:
I am safe and my clients. I don't use that add-on.

Is it the Elementor Pro addon? Because I am using it and my site it clean

anishsahelance said:
Does anyone know how to remove these pages from Google index? We have tried using Google Search Console's "Removal feature" but when I try to submit a removal request for any of these spammy pages, GSC says, "URL not in property".

Manual removal using the Google Search console is your only bet. Also, scan your site using WordFence or Sucuri to make sure it's clean

NulledCode · Mar 11, 2021

And here people are concerned about nulled plugins...

This is the plugin that has the vulnerability and it's already been patched.

Gr00t007 · Mar 11, 2021

anishsahelance said:
Yes my website too got injected with Japanese Keyword Virus. We successfully managed to remove all the malware but there are way too many spam pages indexed on Google.

View attachment 165999

Does anyone know how to remove these pages from Google index? We have tried using Google Search Console's "Removal feature" but when I try to submit a removal request for any of these spammy pages, GSC says, "URL not in property".

Any other solution?

Had a similar attack on my site, a few months back. All I did was cleaning the website and resubmit the sitemap. The spam pages were removed from the website. The indexed spam pages got removed from Google in a few weeks.

IM Dude · Mar 11, 2021

Bloodseeker said:
Is it the Elementor Pro addon? Because I am using it and my site it clean

Manual removal using the Google Search console is your only bet. Also, scan your site using WordFence or Sucuri to make sure it's clean

It's the elementor addon, the free version of addon is fine the paid version got problem. It's in that sej article. It doesn't matter if you are using elementor pro or free, issue is with that paid version of addon.

yeahhub · Mar 11, 2021

Yes its true - https://www.yeahhub.com/30000-sites-risk-plus-addons-elementor-wordpress-plugin-hacked/

bartosimpsonio · Mar 11, 2021

Bloodseeker said:
I read this news: The Plus Addons for Elementor Critical Vulnerability

I didn't take it seriously. But then I checked my Facebook and Reddit, and people are actually reporting that their sites are injected with some codes.

Are you all safe?

Well that sucks.

I am naturally skeptical of themes. I've posted about it several times. Even legit licensed themes have bit me in the past (e.g. the thumbnail vulnerability).

Fixing hacked sites sucks.

Fortunately most my clients use custom developed themes or themes that I've audited and tested myself. Still you're never safe bc one third party addon thing can lead to the whole thing crumbling.

hims.000 · Mar 11, 2021

anishsahelance said:
Yes my website too got injected with Japanese Keyword Virus. We successfully managed to remove all the malware but there are way too many spam pages indexed on Google.

View attachment 165999

Does anyone know how to remove these pages from Google index? We have tried using Google Search Console's "Removal feature" but when I try to submit a removal request for any of these spammy pages, GSC says, "URL not in property".

Any other solution?

Brother don't worry about that... It will automatically removed submit a request on google

DerangedWolf · Mar 11, 2021

Gr00t007 said:
Had a similar attack on my site, a few months back. All I did was cleaning the website and resubmit the sitemap. The spam pages were removed from the website. The indexed spam pages got removed from Google in a few weeks.

Did you use the nulled version of the plugin?

davids355 · Mar 11, 2021

One of my sites got hacked due to this. Two administrator accounts were added with blank usernames, a wp-inc.php file was added to the root directory and a folder with several malicious files in it was added to /all sub-folder. The website was then sending out spam calls to other websites.

To resolve the issue I installed the latest updates for WordPress core, removed elementor as I wasn't actually using it and then installed malcare just to be on the safe side.

Gr00t007 · Mar 11, 2021

Bloodseeker said:
Did you use the nulled version of the plugin?

I used it from Festinger's vault.

AliKashif7 · Mar 11, 2021

I haven't checked my sites. Thanks for sharing the news.

OccultKingdoms · Mar 11, 2021

satyr85 said:
Im safe, I dont use WP and elementor at all.

What kind of solution do you use then? Let us know. Thank you.

DerangedWolf · Mar 11, 2021

Gr00t007 said:
I used it from Festinger's vault.

He doesn't do anything wrong with his items. But you should still report this to him. Maybe what he did to null the plugin left some kind of vulnerability behind

Gr00t007 · Mar 11, 2021

Bloodseeker said:
He doesn't do anything wrong with his items. But you should still report this to him. Maybe what he did to null the plugin left some kind of vulnerability behind

He's a trusted member here, and I use his vault majorly. But I will tag him here just in case @Festinger Though this issue was related to Elementor's old version itself.

Deleted member 752298 · Mar 12, 2021

Gr00t007 said:
He's a trusted member here, and I use his vault majorly. But I will tag him here just in case @Festinger Though this issue was related to Elementor's old version itself.

Thanks for the heads up. The download has immediately been replaced by the updated version without this vulnerability anymore.

Please note that this issue is not related to my services, but a mistake by the original developers, as @yeahhub already confirmed.

https://www.yeahhub.com/30000-sites-risk-plus-addons-elementor-wordpress-plugin-hacked/

ivo1017 · Mar 12, 2021

It is already fixed: https://theplusaddons.com/changelog/. I am with the legal licence and get several emails about the patch.

Elementor Sites Hacked Due to Zero Day Vulnerability

Elite Member

Elite Member

Elite Member

Newbie

Elite Member

Elite Member

Power Member

Elite Member

Regular Member

Elite Member

Senior Member

Elite Member

Super Moderator

Power Member

Regular Member

BANNED

Elite Member

Power Member

Deleted member 752298

Guest

Regular Member

Main Menu

Marketplace

Making Money

BlackHat World