CVE-2024-11852

Description

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a detailed listing of layout templates.

Reserved 2024-11-26 | Published 2024-12-22 | Updated 2024-12-22 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

*
affected

Timeline

2024-12-21:

Disclosed

Credits

Tieu Pham Trong Nhan finder

tptNhan finder

References

www.wordfence.com/...-d48f-4734-95f8-12bd58eb1c2f?source=cve

plugins.trac.wordpress.org/...library/editor/manager/api.php

plugins.trac.wordpress.org/...%2Ftrunk&sfp_email=&sfph_mail=

cve.org (CVE-2024-11852)

nvd.nist.gov (CVE-2024-11852)

Download JSON