PT-2025-1900 · WordPress · The 140+ Widgets | Xpro Addons For Elementor

Craig Smith + 1 · Published 2025-01-08 · Updated 2025-01-08 · CVE-2024-12584

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress versions up to, and including, 1.4.6.2

Description The issue allows authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts through the "duplicate" function. This enables the exposure of confidential information.

Recommendations For versions up to, and including, 1.4.6.2, consider disabling the duplicate function as a temporary workaround until a patch is available. Restrict access to the plugin to minimize the risk of exploitation, especially for users with Contributor-level access and above.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-12584

Affected Products

The 140+ Widgets | Xpro Addons For Elementor

References · 8

• https://osv.dev/vulnerability/CVE-2024-12584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12584 · Security Note
• https://plugins.trac.wordpress.org/changeset/3212531/xpro-elementor-addons · Patch
• https://t.me/cvenotify/106723 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fa085bc0-af0b-4797-a10f-4d41b4988c02?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1876992818880696555 · Twitter Post
• https://twitter.com/CVEnew/status/1876890039961239849 · Twitter Post
• https://t.me/cvedetector/14667 · Telegram Post