CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 via the 'get_post_data' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including the content of private, password-protected, and draft posts and pages.
Explanation of Vulnerability in Simple Terms
HT Mega Addons for Elementor versions up to 2.9.1 contain an improper access control vulnerability. An authenticated user with low privileges can read sensitive information they should not have access to. The vulnerability requires network access and valid login credentials but no additional user interaction. Site administrators should update to a version newer than 2.9.1.
What an attacker can do
Read sensitive information accessible only to higher-privilege users.
Potential impact on your site
Authenticated users can access confidential data beyond their permission level.
Conditions required to exploit
Valid login account with low-level privileges; network access to the site.
Key dates
External resources
Related vulnerabilities
