CVE-2024-7417 Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure

What is CVE-2024-7417?

CVE-2024-7417 is a medium-severity vulnerability in Royal-Elementor-Addons Royal Elementor Addons, published on 17 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_fetch. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected posts.

Weakness: CWE-200

Which versions are affected by CVE-2024-7417?

It affects 1 product.

Products include Royal-Elementor-Addons Royal Elementor Addons.

How do I fix CVE-2024-7417?

No fix has been published for CVE-2024-7417 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-7417 being exploited?

There is no known exploitation of CVE-2024-7417 in the wild and no public exploit code.

Other vulnerabilities in Royal-Elementor-Addons Royal Elementor Addons

• CVE-2023-5360 Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload Critical 9.8
• CVE-2024-1567 Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload High 8.2
• CVE-2023-5922 Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read High 7.5
• CVE-2024-56226 WordPress Royal Elementor Addons plugin <= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2025-39361 WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability Medium 6.5

All Royal-Elementor-Addons Royal Elementor Addons vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mh59-w44g-9pjr.