CVE-2024-10365
📋 TL;DR
This vulnerability allows authenticated WordPress users with Contributor-level access or higher to extract sensitive private, pending, and draft template data from the The Plus Addons for Elementor plugin. The exposure occurs through multiple widget modules, potentially revealing unpublished content and template information. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal unpublished content, proprietary templates, and sensitive draft materials, potentially leading to intellectual property theft, content plagiarism, or exposure of confidential business information before publication.
Likely Case
Malicious contributors or compromised accounts could exfiltrate draft posts, private templates, and unpublished content, enabling content theft or competitive intelligence gathering.
If Mitigated
With proper access controls and monitoring, the impact is limited to potential exposure of draft content that should have been restricted to higher-privileged users.
🎯 Exploit Status
Exploitation requires authenticated access with at least Contributor privileges. The vulnerability is in multiple widget modules including tp_carousel_anything.php and tp_page_scroll.php.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.4 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3186482/the-plus-addons-for-elementor-page-builder
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'The Plus Addons for Elementor'
4. Click 'Update Now' if available
5. Alternatively, download version 6.0.4+ from WordPress.org and manually update
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched
wp plugin deactivate the-plus-addons-for-elementor
Role Restriction
allTemporarily restrict Contributor role access or reduce privileges
Use WordPress role management plugins or custom code to limit Contributor capabilities
🧯 If You Can't Patch
- Implement strict access controls and monitor Contributor-level user activities
- Regularly audit user accounts and remove unnecessary Contributor privileges
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 6.0.3 or lower, you are vulnerable.Check Version:
wp plugin get the-plus-addons-for-elementor --field=versionVerify Fix Applied:
Verify plugin version is 6.0.4 or higher in WordPress admin panel. Test that Contributor users cannot access draft/private template data.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to draft/private content by Contributor users
- Multiple failed attempts to access restricted template endpoints
Network Indicators:
- Unusual outbound traffic containing template/draft data from Contributor accounts
SIEM Query:
source="wordpress" AND (uri_path CONTAINS "tp_carousel_anything" OR uri_path CONTAINS "tp_page_scroll") AND user_role="contributor" AND response_status=200