CVE-2021-24948 The Plus Addons for Elementor Pro < 5.0.7 - Sensitive Data Disclosure
Unauthenticated attackers can retrieve sensitive information, including private and draft posts, via the qvquery parameter in The Plus Addons for Elementor Pro.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24948?
CVE-2021-24948 is a high-severity vulnerability in Unknown The Plus Addons for Elementor - Pro, published on 10 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts
Which versions are affected by CVE-2021-24948?
It affects 1 product.
Products include Posimyth the Plus Addons for Elementor.
How do I fix CVE-2021-24948?
No fix has been published for CVE-2021-24948 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24948 being exploited?
There is no known exploitation of CVE-2021-24948 in the wild and no public exploit code.
Other vulnerabilities in Unknown The Plus Addons for Elementor - Pro
- CVE-2021-24949 The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL Injection
- CVE-2021-24175 The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass
- CVE-2024-5455 Path traversal in The Plus Addons for Elementor Page Builder Pro
- CVE-2021-4331 Privilege escalation in The Plus Addons for Elementor Page Builder Pro
- CVE-2023-47178 WordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerability
Sources
Also known as GHSA-wfmm-h8r7-5hhf.