Sensitive Information Exposure Risk in Elementor Addon

CVE-2024-8979

What is CVE-2024-8979?

The Essential Addons for Elementor plugin for WordPress is susceptible to a sensitive information exposure vulnerability. This flaw exists in all versions up to and including 6.0.9, specifically through the 'init_content_lostpassword_user_email_controls' function. Authenticated attackers with Author-level access or higher can exploit this vulnerability to extract sensitive information, including usernames and passwords of any user, even those with administrative privileges. This exposure occurs when users open email notifications for password change requests, and if their email client does not block images, attackers may easily capture sensitive data.

References