Insecure Direct Object Reference in Education Addon for Elementor Plugin by WordPress

CVE-2024-13854

Summary

The Education Addon for Elementor plugin for WordPress is susceptible to Insecure Direct Object Reference vulnerabilities. This flaw exists in all versions up to and including 1.3.1 and arises from insufficient validation of a user-controlled key within the naedu_elementor_template shortcode. Authenticated attackers with Contributor-level access and above can exploit this weakness to gain unauthorized access to non-public post content, including drafts and password-protected entries. This vulnerability highlights the importance of proper validation protocols to prevent information disclosure in web applications.

References