PT-2022-9522 · WordPress · The Plus Addons For Elementor

Nicolas Vidal · Published 2022-01-10 · Updated 2022-10-25 · CVE-2021-24948

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Plus Addons for Elementor - Pro WordPress plugin versions prior to 5.0.7

Description The issue concerns the lack of validation for the qvquery parameter in the tp get dl post info ajax AJAX action. This could potentially allow unauthenticated users to access sensitive information, including private and draft posts.

Recommendations For versions prior to 5.0.7, update to version 5.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the tp get dl post info ajax AJAX action to prevent unauthenticated users from exploiting the lack of validation for the qvquery parameter.

Exploit

Fix

Information Disclosure

Special Elements Injection

Weakness Enumeration

CWE-200

CWE-74

Related Identifiers

CVE-2021-24948

Affected Products

The Plus Addons For Elementor

References · 4

• 🔥 https://wpscan.com/vulnerability/2b67005a-476e-4772-b15c-3191911a50b0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24948 · Security Note
• https://roadmap.theplusaddons.com/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-24948 · Vendor Advisory