CVE-2024-1387: Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure
The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the duplicatething() function in all versions up to, and including, 3.10.4. This makes it possible for attackers, with contributor-level access and above, to clone arbitrary posts (including private and password protected ones) which may lead to information exposure.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1387?
CVE-2024-1387 has been classified as a medium severity vulnerability due to its potential for unauthorized data access.
How do I fix CVE-2024-1387?
To fix CVE-2024-1387, update the Happy Addons for Elementor plugin to version 3.10.5 or later.
Who is affected by CVE-2024-1387?
CVE-2024-1387 affects users of the Happy Addons for Elementor plugin for WordPress versions up to and including 3.10.4.
What type of access is necessary to exploit CVE-2024-1387?
An attacker needs contributor-level access or higher to exploit CVE-2024-1387.
What functionality is compromised by CVE-2024-1387?
CVE-2024-1387 allows unauthorized users to clone content due to insufficient authorization in the duplicate_thing() function.