Описание
The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts
Ссылки
- Release NotesVendor Advisory
- ExploitThird Party Advisory
- Release NotesVendor Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 5.0.7 (исключая)
cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:pro:wordpress:*:*
EPSS
Процентиль: 82%
0.01662
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-200
CWE-74
Связанные уязвимости
CVSS3: 7.5
github
около 4 лет назад
The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts
EPSS
Процентиль: 82%
0.01662
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-200
CWE-74