CVE-2024-10778: BuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure
The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts crated by Elementor that they should not have access to.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10778?
CVE-2024-10778 has been classified as a medium severity vulnerability.
How do I fix CVE-2024-10778?
To fix CVE-2024-10778, update the BuddyBuilder plugin for WordPress to version 1.7.5 or later.
What type of vulnerability is CVE-2024-10778?
CVE-2024-10778 is an Information Exposure vulnerability.
What versions of BuddyBuilder are impacted by CVE-2024-10778?
CVE-2024-10778 affects all versions of the BuddyBuilder plugin up to and including version 1.7.4.
Who is affected by CVE-2024-10778?
Users of the BuddyPress Builder for Elementor – BuddyBuilder plugin prior to version 1.7.5 are affected by CVE-2024-10778.