CVE-2024-6455
18.07.2024, 21:15
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capability checks on ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, pending and private items.Enginsight
| Vendor | Product | Version |
|---|---|---|
| wpmet | elements_kit_elementor_addons | 𝑥 ≤ 3.2.0 |
| wpmet | elements_kit_elementor_addons | 𝑥 < 3.2.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-862 - Missing AuthorizationThe software does not perform an authorization check when an actor attempts to access a resource or perform an action.
References