CVE-2024-6434: Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service
First published: Thu Jul 04 2024(Updated: )
The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10.35. This is due to processing user-supplied input as a regular expression. This makes it possible for authenticated attackers, with Author-level access and above, to create and query a malicious post title, resulting in slowing server resources.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Leap13 Premium Addons PRO | <4.10.36 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-6434?
CVE-2024-6434 is classified as a medium severity vulnerability due to its potential for exploitation via Regular Expression Denial of Service.
How do I fix CVE-2024-6434?
To remediate CVE-2024-6434, update the Premium Addons for Elementor plugin to version 4.10.36 or later.
Who is affected by CVE-2024-6434?
All versions of the Premium Addons for Elementor plugin for WordPress up to and including 4.10.35 are affected by CVE-2024-6434.
What type of vulnerability is CVE-2024-6434?
CVE-2024-6434 is a Regular Expression Denial of Service (ReDoS) vulnerability.
Can authenticated attackers exploit CVE-2024-6434?
Yes, CVE-2024-6434 can be exploited by authenticated attackers due to the processing of user-supplied input as a regular expression.
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- agent/severity
- agent/remedy
- agent/weakness
- agent/event
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/leap13
- canonical/leap13 premium addons pro