CVE-2024-12584: 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6.2 via the 'duplicate' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12584?
CVE-2024-12584 has a high severity level due to the potential for sensitive information exposure.
How do I fix CVE-2024-12584?
To fix CVE-2024-12584, update the Xpro Addons For Elementor plugin to version 1.4.6.3 or later.
Who is affected by CVE-2024-12584?
All users of the Xpro Addons For Elementor plugin version 1.4.6.2 and earlier are affected by CVE-2024-12584.
What type of vulnerability is CVE-2024-12584?
CVE-2024-12584 is categorized as a Sensitive Information Exposure vulnerability.
What can attackers do with CVE-2024-12584?
Authenticated attackers with Contributor-level access can exploit CVE-2024-12584 to access sensitive information through the duplicate function.