Information Exposure in Builder Shortcode Extras Plugin for WordPress
CVE-2024-13841

4.3MEDIUM

Key Information:

Vendor
WordPress
Status
Builder Shortcode Extras – WordPress Shortcodes Collection To Save You Time
Vendor
CVE Published:
7 February 2025

Summary

The Builder Shortcode Extras plugin for WordPress is susceptible to Information Exposure vulnerabilities due to inadequate restrictions on the 'bse-elementor-template' shortcode. This flaw allows authenticated users with Contributor-level access or higher to potentially retrieve data from private or draft posts created with the Elementor page builder, which they should not be permitted to access. As a result, sensitive information could be exposed to unauthorized individuals, raising serious concerns for website security and user privacy.

Affected Version(s)

Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time * <= 1.0.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/builder-shortc...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.