CVE-2024-10798: Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10798?
CVE-2024-10798 has been classified as a moderate severity vulnerability due to information exposure risks.
How do I fix CVE-2024-10798?
To fix CVE-2024-10798, update the Royal Elementor Addons and Templates plugin to version 1.7.1004 or later.
What type of vulnerability is CVE-2024-10798?
CVE-2024-10798 is categorized as an Information Exposure vulnerability affecting versions up to 1.7.1003.
Who is affected by CVE-2024-10798?
CVE-2024-10798 affects users of the Royal Elementor Addons and Templates plugin for WordPress versions 1.7.1003 and below.
What exploits can occur due to CVE-2024-10798?
Due to CVE-2024-10798, authenticated users may gain unauthorized access to restricted posts.