Sensitive Information Exposure in HT Mega Plugin for WordPress by Absolute Addons
CVE-2023-6214
7.5HIGH
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 2 May 2024
Summary
The HT Mega – Absolute Addons For Elementor plugin for WordPress introduces a vulnerability that exposes sensitive information due to improper access controls in the purchased_products function. This weakness allows unauthenticated attackers to retrieve sensitive data, including order details and personally identifiable information (PII) of customers, from the past seven days. Webmasters and site administrators using this plugin should take immediate action to secure their installations to prevent unauthorized data access.
Affected Version(s)
HT Mega – Absolute Addons For Elementor * <= 2.4.6
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Francesco Carlucci