PT-2024-39348 · WordPress · Essential Addons For Elementor
Wesley
·
Published
2024-11-15
·
Updated
2024-11-19
·
CVE-2024-8979
CVSS v3.1
8.0
High
| Vector | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
The Essential Addons for Elementor plugin for WordPress versions up to, and including, 6.0.9
Description:
The issue allows authenticated attackers with Author-level access and above to extract sensitive data, including usernames and passwords of any user, by exploiting the
init content lostpassword user email controls function. This is possible when a user opens the email notification for a password change request and images are not blocked by the email client.Recommendations:
For versions up to, and including, 6.0.9, upgrade to a patched version immediately to mitigate the risk. As a temporary workaround, consider restricting access to the
init content lostpassword user email controls function until a patch is available. Additionally, users should be cautious when opening email notifications for password change requests, especially if images are not blocked by the email client.Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Essential Addons For Elementor