What the vulnerability does
01Description
The Dollie Hub – Build Your Own WordPress Cloud Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.2.0 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Explanation of Vulnerability in Simple Terms
02Summary
Dollie AI – Connect versions 6.2.0 and earlier contain an authorization flaw that allows authenticated users to access sensitive information they should not be able to view. The vulnerability requires a valid user account but no additional user interaction. An attacker with low-level credentials can read data with restricted access.
What an attacker can do
03Attacker Capabilities
Read sensitive information restricted to other users or roles.
Potential impact on your site
04Site Impact
Authenticated users can access confidential data beyond their permission level.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low-level privileges.
Key dates
06Disclosure timeline
December 4, 2024
CVE published
April 8, 2026
Record updated
