CVE-2024-10312
📋 TL;DR
The Exclusive Addons for Elementor WordPress plugin exposes sensitive template data through a vulnerability in its tabs component. Authenticated attackers with Contributor-level access or higher can extract private, pending, and draft template information. This affects all WordPress sites using the plugin up to version 2.7.4.
💻 Affected Systems
- Exclusive Addons for Elementor WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal unpublished content, proprietary templates, or sensitive draft information before publication, potentially causing intellectual property theft or content manipulation.
Likely Case
Malicious contributors or compromised accounts accessing unpublished content they shouldn't have permission to view, leading to information disclosure.
If Mitigated
Limited impact with proper access controls and monitoring, as exploitation requires authenticated access at Contributor level or higher.
🎯 Exploit Status
Exploitation requires authenticated access at Contributor level or higher. The vulnerability is in the render function of elements/tabs/tabs.php.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.5
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3175285/exclusive-addons-for-elementor
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Exclusive Addons for Elementor'. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.7.5+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Restrict Contributor Access
allTemporarily limit or remove Contributor-level user accounts until patching is complete.
Disable Vulnerable Component
allDisable the tabs element functionality if not essential for site operation.
🧯 If You Can't Patch
- Implement strict access controls and monitor Contributor-level user activities closely.
- Consider temporarily disabling the Exclusive Addons plugin if not critical for site functionality.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Exclusive Addons for Elementor. If version is 2.7.4 or lower, you are vulnerable.Check Version:
wp plugin get exclusive-addons-for-elementor --field=versionVerify Fix Applied:
After updating, verify plugin version shows 2.7.5 or higher in WordPress admin plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to draft/private content by Contributor-level users
- Multiple failed authentication attempts followed by successful Contributor login
Network Indicators:
- Unusual API calls to tabs.php endpoint by authenticated users
SIEM Query:
source="wordpress" AND (uri_path="*tabs.php*" OR plugin="exclusive-addons-for-elementor") AND user_role="contributor"