CVE-2024-6434: Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service
The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10.35. This is due to processing user-supplied input as a regular expression. This makes it possible for authenticated attackers, with Author-level access and above, to create and query a malicious post title, resulting in slowing server resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Premium Addons for Elementorto a version that resolves this vulnerability.Fixed in 4.10.35 - Compensating control
Restrict access to WordPress post-title creation/query capabilities so only trusted users with the minimum required privileges can create or query posts, reducing the impact of authenticated Author-level attackers exploiting the ReDoS vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6434?
CVE-2024-6434 is classified as a medium severity vulnerability due to its potential for exploitation via Regular Expression Denial of Service.
How do I fix CVE-2024-6434?
To remediate CVE-2024-6434, update the Premium Addons for Elementor plugin to version 4.10.36 or later.
Who is affected by CVE-2024-6434?
All versions of the Premium Addons for Elementor plugin for WordPress up to and including 4.10.35 are affected by CVE-2024-6434.
What type of vulnerability is CVE-2024-6434?
CVE-2024-6434 is a Regular Expression Denial of Service (ReDoS) vulnerability.
Can authenticated attackers exploit CVE-2024-6434?
Yes, CVE-2024-6434 can be exploited by authenticated attackers due to the processing of user-supplied input as a regular expression.