CVE-2024-13217: Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas
The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.11 via the 'expireddata' and 'buildcontent' functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13217?
The severity of CVE-2024-13217 is classified as a medium vulnerability due to sensitive information exposure.
How do I fix CVE-2024-13217?
To fix CVE-2024-13217, update the Jeg Elementor Kit plugin to version 2.6.12 or later.
Who is affected by CVE-2024-13217?
Authenticated users with Contributor-level access and above are affected by CVE-2024-13217.
What functions are involved in CVE-2024-13217?
The 'expired_data' and 'build_content' functions are involved in CVE-2024-13217.
What versions of Jeg Elementor Kit are vulnerable to CVE-2024-13217?
All versions of the Jeg Elementor Kit plugin up to and including 2.6.11 are vulnerable to CVE-2024-13217.