sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-12059 ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read

Medium 4.3 Published Updated

Authenticated attackers with Contributor access can read arbitrary WordPress options via a shortcode, exposing sensitive configuration data.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2024-12059?

CVE-2024-12059 is a medium-severity missing authorization vulnerability in ElementInvader Addons for Elementor, published on 12 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the eli_option_value shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract arbitrary options from the wp_options table.

Weakness: CWE-639

Which versions are affected by CVE-2024-12059?

It affects 1 product.

Products include Elementinvader Elementinvader Addons for Elementor.

How do I fix CVE-2024-12059?

No fix has been published for CVE-2024-12059 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-12059 being exploited?

There is no known exploitation of CVE-2024-12059 in the wild and no public exploit code.

Sources

Also known as GHSA-xqjx-3pwp-3529.

Is CVE-2024-12059 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free