Sensitive Information Exposure in Elementor Addons
CVE-2024-2966

7.5HIGH

Key Information:

Vendor
Wordpress
Status
Element Pack Elementor Addons (header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Vendor
CVE Published:
11 April 2024

Summary

The Element Pack Elementor Addons plugin for WordPress is susceptible to a vulnerability that allows unauthenticated attackers to access sensitive information. This issue arises from the element_pack_ajax_search function, which can be exploited to retrieve confidential data, including details of password-protected posts. The vulnerability affects all versions of the plugin up to and including version 5.5.6, highlighting the importance of updating to secure user data against potential threats.

Affected Version(s)

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) * <= 5.5.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3066178/bdth...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.