sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2023-3709 Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure

Medium 5.3 Published Updated

Unauthenticated attackers can obtain MailChimp API keys exposed in page source code by the Royal Elementor Addons plugin.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2023-3709?

CVE-2023-3709 is a medium-severity vulnerability in Royal-Elementor-Addons Royal Elementor Addons, published on 18 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to obtain a site's MailChimp API key. We recommend resetting any MailChimp API keys if running a vulnerable version of this plugin with the MailChimp block enabled as the API key may have been compromised.

Weakness: CWE-200

Which versions are affected by CVE-2023-3709?

It affects 1 product.

Products include Royal-Elementor-Addons Royal Elementor Addons.

How do I fix CVE-2023-3709?

No fix has been published for CVE-2023-3709 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-3709 being exploited?

There is no known exploitation of CVE-2023-3709 in the wild and no public exploit code.

All Royal-Elementor-Addons Royal Elementor Addons vulnerabilities

Sources

Also known as GHSA-6j7m-gh9c-97r6.

Is CVE-2023-3709 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free