CVE-2021-24948

The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts

Score

CVSS 3.1 7.5 High

Status

Modified - contact@wpscan.com

Published

2022-01-10

Last modified

2024-08-03

Weaknesses

CWE-200, CWE-74

Affected products

• The Plus Addons For Elementor (Posimyth)
• The Plus Addons For Elementor - Pro (Unknown)

References

• https://roadmap.theplusaddons.com/updates
• https://wpscan.com/vulnerability/2b67005a-476e-4772-b15c-3191911a50b0