MEDIUM🇵🇱 Wersja polska

CVE-2024-10696

CVSS 4.3v3.1pub. 2024-11-21upd. 2026-04-08

The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.8 via the show_template due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to expose the contents of draft, private, and pending posts.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

  • Codeastrology Ultraaddons

    APP
    Codeastrology
    ≤ 1.1.8
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
IDOR
CWE
References

Related vulnerabilities

CVE-2024-4866MEDIUM6.4ten sam produkt

The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, A...

CVE-2024-37554MEDIUM6.5ten sam produkt

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful I...

CVE-2022-1020CRITICAL9.8ten sam vendor

The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation ...

CVE-2024-10813MEDIUM5.3ten sam vendor

The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to...

CVE-2023-48768MEDIUM4.3ten sam vendor

Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommer...