Information Exposure in Ultimate Template Builder for Elementor Plugin by WordPress
CVE-2024-10868

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Ultimate Template Builder for Elementor
Vendor
CVE Published:
23 November 2024

Summary

The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is susceptible to an information exposure vulnerability in all versions up to and including 2.1.9. This issue arises from insufficient restrictions within the Advanced Tabs widget, allowing authenticated attackers with Contributor-level access and higher to access and potentially extract data from private or draft posts created in Elementor, which they should not normally have permission to view.

References

https://wordpress.org/plugins/enteraddons/
https://www.wordfence.com/threat-intel/vulnerabilities/id...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.