CVE-2024-2966 Information disclosure in Element Pack – Widgets, Templates & Addons for Elementor

What is CVE-2024-2966?

CVE-2024-2966 is a medium-severity vulnerability in bdthemes Element Pack – Widgets, Templates & Addons for Elementor, published on 11 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.6 via the element_pack_ajax_search function. This makes it possible for unauthenticated attackers to extract sensitive data including password protected post details.

Weakness: CWE-200

Which versions are affected by CVE-2024-2966?

It affects 1 product.

Products include Bdthemes Element Pack.

How do I fix CVE-2024-2966?

No fix has been published for CVE-2024-2966 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-2966 being exploited?

There is no known exploitation of CVE-2024-2966 in the wild and no public exploit code.

Other vulnerabilities in bdthemes Element Pack – Widgets, Templates & Addons for Elementor

• CVE-2024-33568 WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability High 8.5
• CVE-2024-30496 WordPress Element Pack Lite plugin <= 5.5.3 - SQL Injection vulnerability High 8.5
• CVE-2024-9657 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor Medium 6.5
• CVE-2024-47392 WordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-4359 Path traversal in Element Pack – Widgets, Templates & Addons for Elementor Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cqp7-2728-738c.