CVE-2024-6455: ElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Function
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capability checks on ekitwidgetareacontent function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, pending and private items.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6455?
CVE-2024-6455 has been classified with a medium severity due to the risk of information exposure for unauthenticated users.
How do I fix CVE-2024-6455?
To fix CVE-2024-6455, update the ElementsKit Elementor addons plugin to version 3.2.1 or later.
Who is affected by CVE-2024-6455?
CVE-2024-6455 affects all versions of the ElementsKit Elementor addons plugin for WordPress up to and including 3.2.0.
What is the consequence of CVE-2024-6455?
The consequence of CVE-2024-6455 is that unauthenticated attackers can view sensitive information stored within the plugin.
What functionality is compromised by CVE-2024-6455?
CVE-2024-6455 compromises the ekit_widgetarea_content function by lacking necessary capability checks.