CVE-2024-10802: Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure
The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hashelementsgetpoststitlebyid() function in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated attackers to retrieve draft post titles that should not be accessible to unauthenticated users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10802?
CVE-2024-10802 is considered a medium severity vulnerability due to the potential for unauthorized data access.
How do I fix CVE-2024-10802?
To fix CVE-2024-10802, update the Hash Elements plugin to version 1.4.8 or later where the vulnerability has been addressed.
What does CVE-2024-10802 affect?
CVE-2024-10802 affects the Hash Elements plugin for WordPress versions up to and including 1.4.7.
Who can exploit CVE-2024-10802?
CVE-2024-10802 can be exploited by unauthenticated attackers due to the lack of capability checks.
What type of data can be accessed due to CVE-2024-10802?
CVE-2024-10802 allows unauthorized access to potentially sensitive data from posts retrieved by the vulnerable function.