CVE-2024-13217
📋 TL;DR
The Jeg Elementor Kit WordPress plugin exposes sensitive template data through insecure functions. Authenticated attackers with Contributor-level access or higher can extract private, pending, scheduled, and draft template content. This affects all WordPress sites using vulnerable plugin versions.
💻 Affected Systems
- Jeg Elementor Kit WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal unpublished content, intellectual property, or sensitive draft materials before publication, potentially causing business disruption or competitive harm.
Likely Case
Malicious contributors or compromised accounts accessing unpublished content they shouldn't have permission to view.
If Mitigated
Limited to authenticated users with at least Contributor access, reducing exposure compared to unauthenticated vulnerabilities.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once authenticated. The vulnerability details are publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.12 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3246154/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Jeg Elementor Kit' and click 'Update Now'. 4. Verify plugin version is 2.6.12 or higher.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched
wp plugin deactivate jeg-elementor-kit
Restrict User Roles
allTemporarily limit Contributor and higher role assignments
🧯 If You Can't Patch
- Remove Contributor and higher access from untrusted users
- Monitor user activity logs for suspicious template access patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Jeg Elementor Kit versionCheck Version:
wp plugin get jeg-elementor-kit --field=versionVerify Fix Applied:
Confirm plugin version is 2.6.12 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual access to template-related endpoints by Contributor users
- Multiple requests to countdown-view.php or off-canvas-view.php with suspicious parameters
Network Indicators:
- HTTP requests to vulnerable plugin endpoints with 'expired_data' or 'build_content' parameters
SIEM Query:
source="wordpress" AND (uri_path="*countdown-view.php*" OR uri_path="*off-canvas-view.php*") AND user_role="contributor"🔗 References
- https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/trunk/class/elements/views/class-countdown-view.php#L107
- https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/trunk/class/elements/views/class-off-canvas-view.php#L25
- https://plugins.trac.wordpress.org/changeset/3246154/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2136cad8-6b0b-4458-a357-6e98f1ac3e0b?source=cve
