CVE-2024-9889: ElementInvader Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Information Exposure
First published: Sat Oct 19 2024(Updated: )
The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.9 via the Page Loader widget. This makes it possible for authenticated attackers, with contributor-level access and above, to view private/draft/password protected posts, pages, and Elementor templates that they should not have access to.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ElementInvader Addons for Elementor | <1.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd04f78-0b9c-4985-b450-007bb5cc9e26?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3171339%40elementinvader-addons-for-elementor&new=3171339%40elementinvader-addons-for-elementor&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-9889?
CVE-2024-9889 is considered a moderate severity vulnerability due to the sensitive information exposure it causes.
How do I fix CVE-2024-9889?
To fix CVE-2024-9889, update the ElementInvader Addons for Elementor plugin to version 1.3.0 or later.
Who is affected by CVE-2024-9889?
CVE-2024-9889 affects all versions of the ElementInvader Addons for Elementor plugin for WordPress up to and including 1.2.9.
What kind of information can be exposed with CVE-2024-9889?
CVE-2024-9889 can lead to the exposure of sensitive information accessible to authenticated users with contributor-level access or higher.
Is there a known exploit for CVE-2024-9889?
While there is no publicly disclosed exploit for CVE-2024-9889, the vulnerability itself poses a risk to user data if not mitigated.
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/trending
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/elementinvader
- canonical/elementinvader addons for elementor