Ongoing Elementor Vulnerability and Hack – Solution

Two of my client’s sites have recently been hit with the exact same website hack that I believe exploits a vulnerability found in versions 3.6.0 through 3.6.2. While the vulnerability has been fully described as a “remote code execution vulnerability,” I have not seen anyone describe any widespread attacks actually exploiting it. Until now!

Well, friends, I am here to describe exactly how it works and how you can fix it.

Note: it’s likely this same attack will be used for future exploits of Elementor and other plugins, too. So if you’ve seen any of these symptoms but don’t use Elementor: read on.

Once your site is exploited, the attackers quickly add a handful of malicious files to your website. As far as I can tell, mostly all they do is redirect logged-out visitors and search engine traffic to spam sites. But I’ve also found that many functions of your site – especially e-commerce sites – may break as well.

Specific Markers of this Hack

I found that the symptoms of this hack were identical in both instances. Specifically I found the following:

  1. A new plugin installed (but deactivated) identifying itself in the backend as “Cool Timelline” (sic). The most heinous thing about this is that the plugin is not, in fact, cool at all. A screenshot of the inactive plugin that the hackers install on the plugins screen of WordPressThis plugin actually exists in the plugins folder as “wp-sp”. Note that I’ve heard reports of it being called “wp-pimple” as well.
    Screenshot of the wp-sp hack folderThe plugin contains 4 files, all malicious:
    class.php
    clone.php
    index.php
    simple.php
    Screenshot showing the contents of the wp-sp plugin folder
  2. A file in the site root called “slicemap.php”. The code within in obfuscated but certainly malicious. Other users have reported that it was called simply “class.php”.Screenshot of the slicemap.php file in the WordPress root
    Screenshot of some of the content of the slicemap.php file

    Here is some of the content of that file

  3. Malicious code is injected into the core WordPress file wp-blog-header.php. I forgot to check the contents of it before I deleted it, but I suspect that this is where the redirects happen.
  4. Logged-out users get redirected to spam sites. In my case, we logged a bunch of redirects and spam sites including the following domains (don’t go to these, they are likely infected or otherwise malicious):

 

If you use the popular (and recommended) WordFence plugin, your scan results would likely look much like this:

Screenshot showing the WordFence scan results, indicating a hack of the Elementor vulnerability

This should actually be a conclusive list of the files that are changed from this attack.

So how do we fix a WordPress website infected with this attack?

Fortunately, it’s not too difficult!

*Note: I recommend backing up your entire site and database before engaging in any of this. If you don’t know what you’re doing hear, I recommend hiring a WordPress expert to take care of it for you.

  1. Update your Elementor plugin. This was the original source of the attack, and it makes sense to close that door before dealing with the attack.
  2. Delete the “Cool Timelline” / wp-sp plugin. You can do this from the WordPress backend, or you could navigate to /wp-content/plugins/ and delete the “wp-sp” folder.
  3. Delete the “slicemap.php” file located in the website route.
  4. Reinstall the newest WordPress version from the “Updates” screen in the backend to reset the core files. From the backend, go to Dashboard -> Updates -> “Re-install version 5.9.3” (or whatever version they’re currently at as of the time of this reading). Or just update to the newest version if you aren’t there yet.
  5. Review the list of Administrators on your account and remove any suspicious accounts.
  6. Reset all administrator passwords.
  7. (Recommended) Install the WordFence plugin and run a scan to make sure you got everything.
  8. (Recommended) Reset the database password for your website. This is recommended because it’s possible the attackers saved this database connection info and will return at a later date.

And that should do it! Luckily this hack doesn’t seem to be too pervasive, so you should be able to remedy it fairly easily. The biggest issue is that you may not notice there’s a problem for some time, as logged-in users don’t get redirected.

About Brian Johnson

Brian Johnson is a website developer and designer living in Minneapolis, Minnesota with a passion for code and WordPress. He spends his days building WordPress websites for small businesses, developing new code with the online community, and living life.

4 Comments on “Ongoing Elementor Vulnerability and Hack – Solution”

  1. FYI, on our server it was in the plugins folder in a folder called wp-pimple, and slicemap.php was instead called class.php, but the contents were the same

  2. Thanks for this post, it saved me a lot of time in identifying the hack. Much appreciated.
    (I can’t believe Elementor have done nothing to warn users!!)
    However, for me, removing the files didn’t fix the issue. The database was infected too, so I had to roll that back to an old backup.

    1. I’m sorry to hear that! That’s good to know, though. I wonder if your hack was simply more advanced.

Leave a Reply

Your email address will not be published.