WordPress Elementor Addon Elements Sensitive Information Exposure via table_saved_sections (CVE-2024-8902)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections 2. Affected Software: Elementor Addon Elements plugin 3. Affected Versions: <= 1.13.8 4. Fix Status: Patched 5. Fixed Version: 1.13.9 6. Vulnerability Type: Sensitive Information Exposure 7. CVSS Score: 4.3 (Medium) 8. Public Disclosure Date: October 11, 2024 9. Update Date: October 12, 2024 10. Researcher: Ankit Patel 11. Vulnerability Description: The plugin contains a sensitive information exposure vulnerability in all versions (including <= 1.13.8), allowing attackers with Contributor+ privileges to extract sensitive private, pending, and draft template data via the table_saved_sections functionality. 12. Reference Link: plugins.trac.wordpress.org 13. Vulnerability Score: 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 14. Vulnerability ID: CVE-2024-8902 15. Vulnerability Severity: Medium 16. Vulnerability Disclosure Time: October 11, 2024 17. Last Update Time: October 12, 2024 18. Researcher: Ankit Patel 19. Vulnerability Description: The plugin contains a sensitive information exposure vulnerability in all versions (including <= 1.13.8), allowing attackers with Contributor+ privileges to extract sensitive private, pending, and draft template data via the table_saved_sections functionality. 20. Vulnerability Score: 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 21. Vulnerability Disclosure Time: October 11, 2024 22. Last Update Time: October 12, 2024 23. Researcher: Ankit Patel 24. Vulnerability Description: The plugin contains a sensitive information exposure vulnerability in all versions (including <= 1.13.8), allowing attackers with Contributor+ privileges to extract sensitive private, pending, and draft template data via the table_saved_sections functionality. 25. Vulnerability Score: 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 26. Vulnerability Disclosure Time: October 11, 2024 27. Last Update Time: October 12, 2024 28. Researcher: Ankit Patel 29. Vulnerability Description: The plugin contains a sensitive information exposure vulnerability in all versions (including <= 1.13.8), allowing attackers with Contributor+ privileges to extract sensitive private, pending, and draft template data via the table_saved_sections functionality. 30. Vulnerability Score: 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 31. Vulnerability Disclosure Time: October 11, 2024 32. Last Update Time: October 12, 2024 33. Researcher: Ankit Patel 34. Vulnerability Description: The plugin contains a sensitive information exposure vulnerability in all versions (including <= 1.13.8), allowing attackers with Contributor+ privileges to extract sensitive private, pending, and draft template data via the table_saved_sections functionality. 35. Vulnerability Score: 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 36. Vulnerability Disclosure Time: October 11, 2024 37. Last Update Time: October 12, 2024 38. Researcher: Ankit Patel 39. Vulnerability Description: The plugin contains a sensitive information exposure vulnerability in all versions (including <= 1.13.8), allowing attackers with Contributor+ privileges to extract sensitive private, pending, and draft template data via the table_saved_sections functionality. 40. Vulnerability Score: 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 41. Vulnerability Disclosure Time: October 11, 2024 42. Last Update Time: October 12, 2024 43. Researcher: Ankit Patel 44. Vulnerability Description: The plugin contains a sensitive information exposure vulnerability in all versions (including <= 1.13.8), allowing attackers with Contributor+ privileges to extract sensitive private, pending, and draft template data via the table_saved_sections functionality. 45. Vulnerability Score: 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 46. Vulnerability Disclosure Time: October 11, 2024 47. Last Update Time: October 12, 2024 48. Researcher: Ankit Patel 49. Vulnerability Description: The plugin contains a sensitive information exposure vulnerability in all versions (including <= 1.13.8), allowing attackers with Contributor+ privileges to extract sensitive private, pending, and draft template data via the table_saved_sections functionality. 50. Vulnerability Score: 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 51. Vulnerability Disclosure Time: October 11, 2024 52. Last Update Time: October 12, 2024 53. Researcher: Ankit Patel 54. Vulnerability Description: The plugin contains a sensitive information exposure vulnerability in all versions (including <= 1.13.8), allowing attackers with Contributor+ privileges to extract sensitive private, pending, and draft template data via the table_saved_sections functionality. 55. Vulnerability Score: 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 56. Vulnerability Disclosure Time: October 11, 2024 57. Last Update Time: October 12, 2024 58. Researcher: Ankit Patel 59. Vulnerability Description:

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Elementor Addon Elements Sensitive Information Exposure via table_saved_sections (CVE-2024-8902)

More from this source