CVE-2024-8979: Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'initcontentlostpassworduseremailcontrols' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including usernames and passwords of any user, including Administrators, as long as that user opens the email notification for a password change request and images are not blocked by the email client.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8979?
CVE-2024-8979 is classified as a vulnerability that allows for Sensitive Information Exposure.
How do I fix CVE-2024-8979?
To fix CVE-2024-8979, update the Essential Addons for Elementor plugin to version 6.0.10 or later.
Which versions of Essential Addons for Elementor are affected by CVE-2024-8979?
All versions of Essential Addons for Elementor up to and including 6.0.9 are affected by CVE-2024-8979.
What specific function is associated with CVE-2024-8979?
The 'init_content_lostpassword_user_email_controls' function is linked to the CVE-2024-8979 vulnerability.
Can CVE-2024-8979 expose user information?
Yes, CVE-2024-8979 can lead to the exposure of sensitive user information.