CVE-2024-10050 Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode

What is CVE-2024-10050?

CVE-2024-10050 is a medium-severity vulnerability in brainstormforce Ultimate Addons for Elementor, published on 24 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfe_template shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the contents of Draft, Private and Password-protected posts they do not own.

Weakness: CWE-200

Which versions are affected by CVE-2024-10050?

It affects 1 product.

Products include Brainstormforce Elementor Header \& Footer Builder.

How do I fix CVE-2024-10050?

No fix has been published for CVE-2024-10050 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-10050 being exploited?

There is no known exploitation of CVE-2024-10050 in the wild and no public exploit code.

Other vulnerabilities in brainstormforce Ultimate Addons for Elementor

• CVE-2024-11230 Cross-site scripting in Ultimate Addons for Elementor Medium 6.4
• CVE-2024-10325 Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Medium 6.4
• CVE-2024-2618 Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium 6.4
• CVE-2024-4634 Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium 6.4
• CVE-2024-1237 Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gxq3-h9h6-4fpj.