BuddyBuilder Plugin for WordPress Vulnerable to Information Exposure

CVE-2024-10778

Summary

The BuddyPress Builder for Elementor plugin, including all versions up to 1.7.4, suffers from an Information Exposure issue due to inadequate restrictions on the 'elementor-template' shortcode. This vulnerability allows authenticated attackers, who possess Contributor-level access or higher, to inadvertently access and extract data from private or draft posts created using Elementor, which they normally should not be permitted to view. This could lead to unauthorized disclosure of sensitive information contained within those posts.

References