Lucene search

K
wpvulndbWpvulndbWPVDB-ID:CB4408F7-947B-4C5B-9C7D-B92D41DD916D
HistoryApr 05, 2024 - 12:00 a.m.

Happy Addons for Elementor < 3.10.5 - Incorrect Authorization to Information Exposure

2024-04-0500:00:00
wpscan.com
6
happy addons
elementor
wordpress
unauthorized access
data exposure

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0

Percentile

15.5%

Description The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the duplicate_thing() function in all versions up to, and including, 3.10.4. This makes it possible for attackers, with contributor-level access and above, to clone arbitrary posts (including private and password protected ones) which may lead to information exposure.

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0

Percentile

15.5%

Related for WPVDB-ID:CB4408F7-947B-4C5B-9C7D-B92D41DD916D