CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render' function in modules/modal-popup/widgets/modal-popup.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.
Explanation of Vulnerability in Simple Terms
Addon Elements for Elementor versions up to 1.13.10 contain a privacy disclosure vulnerability. An authenticated user with low privileges can access sensitive information they should not be able to view. The vulnerability requires network access and valid login credentials but no additional user interaction. Update to a version newer than 1.13.10 to resolve this issue.
What an attacker can do
Read sensitive information accessible only to higher-privileged users or other site visitors.
Potential impact on your site
User data or site information may be exposed to authenticated users who should not have access to it.
Conditions required to exploit
Attacker must have a valid low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
