CVE-2024-10787

Summary

CVE-2024-10787 is a newly disclosed vulnerability affecting the LA-Studio Element Kit plugin for WordPress. This Information Exposure issue, present in all versions up to 1.4.4, allows authenticated attackers with Contributor-level access or higher to access data from private and draft posts created by Elementor. The vulnerability stems from insufficient restrictions on which posts can be included using the 'elementor-template' shortcode. This weakness can potentially lead to sensitive information being exposed to unauthorized individuals. WordPress users are encouraged to update the plugin to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.