CVE-2024-10775: Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosure
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.4.32 via the 'pafe-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10775?
CVE-2024-10775 has been classified as a high severity vulnerability due to the potential for information exposure.
How do I fix CVE-2024-10775?
To fix CVE-2024-10775, update the Piotnet Addons For Elementor plugin to version 2.4.33 or later.
What does CVE-2024-10775 exploit?
CVE-2024-10775 exploits insufficient restrictions on the 'pafe-template' shortcode, allowing unauthorized access to posts.
Who is affected by CVE-2024-10775?
CVE-2024-10775 affects all versions of the Piotnet Addons For Elementor plugin up to and including 2.4.32.
What type of vulnerability is CVE-2024-10775?
CVE-2024-10775 is categorized as an Information Exposure vulnerability.