CVE-2024-13854

Summary

CVE-2024-13854 is a vulnerability affecting the Education Addon for Elementor plugin used in WordPress sites. The issue lies in the naedu_elementor_template shortcode, which fails to validate user-controlled keys properly. This flaw allows authenticated attackers with Contributor-level access or higher to access non-public posts, including drafts, password-protected, and restricted ones. The vulnerability only impacts posts created using Elementor.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.