CVE-2024-10777

Summary

CVE-2024-10777 is a newly disclosed vulnerability affecting the AnyWhere Elementor plugin for WordPress. This issue, present in versions up to 1.2.11, allows authenticated attackers with Contributor-level access or higher to access private or draft posts created by Elementor. The vulnerability arises due to insufficient restrictions on which posts can be included using the 'INSERT_ELEMENTOR' shortcode, enabling attackers to extract sensitive information they should not be privy to.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.