CVE-2024-10352: Magical Addons For Elementor <= 1.2.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the getcontenttype function in includes/widgets/content-reveal.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10352?
CVE-2024-10352 has a high severity level due to its potential for sensitive information exposure.
How do I fix CVE-2024-10352?
To fix CVE-2024-10352, update the Magical Addons For Elementor plugin to version 1.2.5 or higher.
Who is affected by CVE-2024-10352?
CVE-2024-10352 affects all versions of the Magical Addons For Elementor plugin up to and including version 1.2.4.
What type of vulnerability is CVE-2024-10352?
CVE-2024-10352 is classified as a Sensitive Information Exposure vulnerability.
Can an unauthenticated user exploit CVE-2024-10352?
No, only authenticated attackers with contributor access can exploit CVE-2024-10352.