CVE-2024-6824: Premium Addons for Elementor <= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Update
The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'checktempvalidity' and 'updatetemplatetitle' functions in all versions up to, and including, 4.10.38. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary content and update post and page titles.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6824?
CVE-2024-6824 is considered a critical vulnerability due to its potential for unauthorized modification and loss of data.
How do I fix CVE-2024-6824?
To fix CVE-2024-6824, update the Premium Addons for Elementor plugin to version 4.10.39 or later.
What versions are affected by CVE-2024-6824?
CVE-2024-6824 affects all versions of the Premium Addons for Elementor plugin up to and including version 4.10.38.
What functions are vulnerable in CVE-2024-6824?
The functions 'check_temp_validity' and 'update_template_title' are vulnerable in CVE-2024-6824 due to missing capability checks.
Is CVE-2024-6824 easy to exploit?
Yes, CVE-2024-6824 is relatively easy to exploit due to insufficient access controls, potentially allowing unauthorized users to modify data.