MEDIUM🇬🇧 English

CVE-2024-10696

CVSS 4.3v3.1pub. 2024-11-21upd. 2026-04-08

The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.8 via the show_template due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to expose the contents of draft, private, and pending posts.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

  • Codeastrology Ultraaddons

    APP
    Codeastrology
    ≤ 1.1.8
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
IDOR
CWE
Referencje

Powiązane podatności

CVE-2024-4866MEDIUM6.4ten sam produkt

The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, A...

CVE-2024-37554MEDIUM6.5ten sam produkt

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful I...

CVE-2022-1020CRITICAL9.8ten sam vendor

The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation ...

CVE-2024-10813MEDIUM5.3ten sam vendor

The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to...

CVE-2023-48768MEDIUM4.3ten sam vendor

Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommer...