CVE-2024-10329 Ultimate Bootstrap Elements for Elementor <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure

What is CVE-2024-10329?

CVE-2024-10329 is a medium-severity vulnerability in g5theme Ultimate Bootstrap Elements for Elementor, published on 5 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the 'ube_get_page_templates' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the contents of templates that are private.

Weakness: CWE-200

Which versions are affected by CVE-2024-10329?

It affects 1 product.

Products include G5plus Ultimate Bootstrap Elements for Elementor.

How do I fix CVE-2024-10329?

No fix has been published for CVE-2024-10329 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-10329 being exploited?

There is no known exploitation of CVE-2024-10329 in the wild and no public exploit code.

Other vulnerabilities in g5theme Ultimate Bootstrap Elements for Elementor

• CVE-2024-13545 Bootstrap Ultimate <= 1.4.9 - Unauthenticated Limited Local File Inclusion Critical 9.8
• CVE-2024-37462 WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.2 - Local File Inclusion vulnerability High 8.5
• CVE-2024-43140 WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.4 - Local File Inclusion vulnerability High 7.5
• CVE-2024-2132 Cross-site scripting in Ultimate Bootstrap Elements for Elementor Medium 6.4
• CVE-2024-1398 Ultimate Bootstrap Elements for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-88m6-45c8-3f97.