ET WEB_SPECIFIC_APPS WordPress Plugin - Essential Addons for Elementor - Password Reset Attempt (CVE-2023-32243)

alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (
    msg:"ET WEB_SPECIFIC_APPS WordPress Plugin - Essential Addons for Elementor - Password Reset Attempt (CVE-2023-32243)";
    flow:established,to_server;
    flowbits:set,ET.CVE-2023-32243;
    http.method;
    content:"POST";
    http.uri;
    content:"admin-ajax.php"; endswith;
    http.request_body;
    content:"action";
    content:"login_or_register_user"; within:28;
    content:"eael-resetpassword-submit"; fast_pattern;
    content:"true"; nocase; within:10;
    content:"page_id";
    content:"widget_id";
    content:"eael-resetpassword-nonce";
    content:"eael-pass1";
    content:"eael-pass2";
    content:"rp_login";
    reference:url,patchstack.com/articles/critical-privilege-escalation-in-essential-addons-for-elementor-plugin-affecting-1-million-sites/;
    reference:cve,2023-32243;
    classtype:attempted-admin;
    sid:2045879; rev:1;
    metadata:affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2023_05_30, cve CVE_2023_32243, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, updated_at 2023_05_30;
    target:dest_ip;
)