PT-2024-37623 · WordPress · Premium Addons For Elementor

Muhammad Umer Adeem + 1 · Published 2024-07-04 · Updated 2024-07-05 · CVE-2024-6434

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.35

Description The issue is related to Regular Expression Denial of Service (ReDoS) due to the processing of user-supplied input as a regular expression. This allows authenticated attackers with Author-level access and above to create and query a malicious post title, resulting in the slowing of server resources.

Recommendations For versions up to, and including, 4.10.35, update to a version later than 4.10.35 to resolve the issue. As a temporary workaround, consider restricting access to post title creation and querying to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2024-6434

Affected Products

Premium Addons For Elementor

References · 7

• https://plugins.trac.wordpress.org/changeset/3110991 · Patch
• https://osv.dev/vulnerability/CVE-2024-6434 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6434 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3c59d95a-b7f1-4a04-bbf4-bab2c42d6d75?source=cve · Note
• https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/includes/class-premium-template-tags.php#L1676 · Note
• https://twitter.com/CVEnew/status/1808785587656134815 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1808812405910069443 · Twitter Post