Insecure Direct Object Reference in Medical Addon for Elementor Plugin by WordPress

CVE-2024-12046

Summary

The Medical Addon for Elementor plugin on WordPress is susceptible to an Insecure Direct Object Reference vulnerability. This issue arises from inadequate validation of a user-controlled key within the 'namedical_elementor_template' shortcode. As a result, authenticated attackers with Contributor-level access or higher can exploit this flaw to access and read the contents of draft, pending, and private posts, potentially exposing sensitive data.

References