Vulnerability in 'elementor-template' Shortcode Exposes Private Posts
CVE-2024-12099

4.3MEDIUM

Key Information:

Vendor

Wordpress
Vendor
CVE Published:
4 December 2024

What is CVE-2024-12099?

The Dollie Hub – Build Your Own WordPress Cloud Platform plugin for WordPress has a significant vulnerability that allows authenticated attackers, including those with Contributor-level access and above, to exploit an information exposure issue. This flaw arises from insufficient restrictions on the 'elementor-template' shortcode, enabling unauthorized users to access data from password-protected, private, or draft posts. It is crucial for users to ensure they are using the latest version of this plugin to mitigate potential risks and safeguard sensitive information.

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
https://www.wordfence.com/threat-intel/vulnerabilities/id...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.