Sensitive Information Exposure Vulnerability in Move Addons for Elementor

CVE-2024-10360
4.3MEDIUM

Key Information

Vendor
Moveaddons
Status
Move Addons For Elementor
Vendor
CVE Published:
29 October 2024

Summary

The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the render function in includes/widgets/accordion/widget.php, includes/widgets/remote-template/widget.php, and other widget.php files. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.

Affected Version(s)

Move Addons for Elementor <= 1.3.5

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published.

  • Disclosed

  • Vulnerability Reserved.

  • Vendor Notified

Collectors

NVD DatabaseMitre Database

Credit

Ankit Patel
.