WordPress · The Plus Addons For Elementor · CVE-2024-10365
**Name of the Vulnerable Software and Affected Versions**
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress versions up to, and including, 6.0.3
**Description**
The issue concerns sensitive information exposure. Authenticated attackers with Contributor-level access and above can extract sensitive private, pending, and draft template data via the render function in modules/widgets/tp carousel anything.php, modules/widgets/tp page scroll.php, and other widgets.
**Recommendations**
For versions up to, and including, 6.0.3, update to a version higher than 6.0.3 to resolve the issue.
As a temporary workaround, consider restricting access to the render function in modules/widgets/tp carousel anything.php, modules/widgets/tp page scroll.php, and other widgets to minimize the risk of exploitation.
Restrict access to sensitive private, pending, and draft template data until the issue is resolved.