CVE-2024-12061: Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure
The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naeventselementortemplate shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12061?
CVE-2024-12061 has been classified as a medium severity vulnerability due to information exposure risks.
How do I fix CVE-2024-12061?
To fix CVE-2024-12061, upgrade the Events Addon for Elementor plugin to version 2.2.4 or higher.
What versions of the Events Addon for Elementor are affected by CVE-2024-12061?
All versions of the Events Addon for Elementor up to and including version 2.2.3 are affected by CVE-2024-12061.
What type of vulnerability is CVE-2024-12061?
CVE-2024-12061 is an information exposure vulnerability due to insufficient restrictions in the naevents_elementor_template shortcode.
Who is the vendor associated with CVE-2024-12061?
The vendor associated with CVE-2024-12061 is Elementor, which develops the Events Addon for Elementor plugin.