CVE-2024-8902 Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections
MediumCVSS 4.3
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the render_column function in modules/data-table/widgets/data-table.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress addon-elements-for-elementor-page-builder(WordPress) | < 1.13.9 | 1.13.9 |
| WPVibes Addon Elements for Elementor (formerly Elementor Addon Elements) | <= 1.13.8 | No fix listed |
| webtechstreet elementor addon elements | < 1.13.9 | 1.13.9 |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- www.wordfence.com third-party-advisory
- plugins.trac.wordpress.org patch