CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchased_products function. This makes it possible for unauthenticatied attackers to extract sensitive data including the previous 7 days of order data including products and customer PII.
Explanation of Vulnerability in Simple Terms
HT Mega Addons for Elementor versions up to 2.4.6 expose sensitive information to unauthenticated attackers over the network. The plugin fails to properly restrict access to data that should be private. An attacker can read this information without needing to log in or interact with a site user. Update to a version newer than 2.4.6 to resolve this issue.
What an attacker can do
Read sensitive information from the plugin without authentication.
Potential impact on your site
Sensitive data stored or processed by HT Mega Addons may be exposed to the public internet.
Conditions required to exploit
Network access only; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
