Sensitive Information Exposure in All-in-One Addons for Elementor by WordPress

CVE-2024-10321

Summary

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is exposed to sensitive information leakage, affecting all versions up to and including 2.5.4. The vulnerability exists in the elements/advanced-tab/template/view.php file, allowing authenticated attackers with Contributor-level access or higher to extract sensitive private, pending, and draft template data. This exposure could lead to unauthorized access to sensitive site content, highlighting the need for immediate updates and proper security measures to protect user data.

References