CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 via the ajax_eae_post_data function. This can allow unauthenticated attackers to extract sensitive data including post/page ids and titles including those of with pending/draft/future/private status.
Explanation of Vulnerability in Simple Terms
Addon Elements for Elementor fails to properly check user permissions before allowing access to certain functions. An unauthenticated attacker can read limited non-sensitive information from the site without logging in. The vulnerability affects all versions up to 1.12.7. Update to a version newer than 1.12.7 to resolve this issue.
What an attacker can do
Read limited non-sensitive information from the site without authentication.
Potential impact on your site
Unauthenticated visitors can access information that should be restricted to logged-in users.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
