Information Exposure in Builder Shortcode Extras Plugin for WordPress
CVE-2024-13841
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 February 2025
What is CVE-2024-13841?
The Builder Shortcode Extras plugin for WordPress is susceptible to Information Exposure vulnerabilities due to inadequate restrictions on the 'bse-elementor-template' shortcode. This flaw allows authenticated users with Contributor-level access or higher to potentially retrieve data from private or draft posts created with the Elementor page builder, which they should not be permitted to access. As a result, sensitive information could be exposed to unauthorized individuals, raising serious concerns for website security and user privacy.
Affected Version(s)
Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time * <= 1.0.0