Sensitive Information Exposure in RomethemeKit For Elementor Plugin by WordPress

CVE-2024-10324

Summary

The RomethemeKit For Elementor plugin is susceptible to sensitive information exposure due to a flaw in the register_controls function found in the widgets/offcanvas-rometheme.php file. This vulnerability affects all versions up to and including 1.5.2 and can be exploited by authenticated users with Contributor-level access or higher, allowing them to gain access to confidential data, including private, pending, and draft templates. It is crucial for users and administrators of this plugin to take immediate action to mitigate the risk of unauthorized data exposure.

References