Information Exposure Vulnerability in Piotnet Addons for Elementor by WordPress
CVE-2024-10775

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Piotnet Addons For Elementor
Vendor
CVE Published:
15 January 2025

Summary

The Piotnet Addons For Elementor plugin for WordPress is susceptible to an information exposure vulnerability in all versions up to and including 2.4.32. This vulnerability arises from inadequate restrictions on the 'pafe-template' shortcode, enabling authenticated attackers with Contributor-level access or higher to retrieve data from private or draft posts created by Elementor that they should not be able to access. This potential for unauthorized data extraction poses significant security concerns for users and developers alike.

Affected Version(s)

Piotnet Addons For Elementor * <= 2.4.32

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.