CVE-2024-13855
📋 TL;DR
This vulnerability allows authenticated WordPress users with Contributor-level access or higher to bypass access controls and view non-public posts (drafts, private, password-protected, or restricted) created with Elementor. It affects all WordPress sites using the Prime Addons for Elementor plugin up to version 2.0.1.
💻 Affected Systems
- Prime Addons for Elementor WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive unpublished content, confidential drafts, or restricted posts could be exposed to unauthorized users, potentially leading to information disclosure, intellectual property theft, or regulatory compliance violations.
Likely Case
Contributors or authors could view each other's draft posts or access private content they shouldn't see, violating content separation and potentially exposing sensitive information.
If Mitigated
With proper user role management and content access controls, the impact is limited to authorized users viewing content they shouldn't access, but no system compromise occurs.
🎯 Exploit Status
Exploitation requires authenticated access (Contributor role or higher). The vulnerability is in the pae_global_block shortcode parameter handling.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.2 or later
Vendor Advisory: https://wordpress.org/plugins/prime-addons-for-elementor/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'Prime Addons for Elementor'. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.0.2+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable vulnerable shortcode
allRemove or disable the pae_global_block shortcode functionality
Add to theme functions.php: remove_shortcode('pae_global_block');
Restrict user roles
allTemporarily limit Contributor and Author access until patched
Use WordPress role management plugins to restrict access
🧯 If You Can't Patch
- Temporarily deactivate the Prime Addons for Elementor plugin
- Implement strict user role auditing and monitor for unusual post access patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Prime Addons for Elementor → Version. If version is 2.0.1 or lower, you are vulnerable.Check Version:
wp plugin list --name='prime-addons-for-elementor' --field=versionVerify Fix Applied:
After updating, verify plugin version is 2.0.2 or higher in WordPress admin plugins page.📡 Detection & Monitoring
Log Indicators:
- Unusual access to non-public posts by users
- Multiple requests to pae_global_block shortcode with different IDs
Network Indicators:
- HTTP requests containing 'pae_global_block' parameter with sequential or unusual post IDs
SIEM Query:
source="wordpress" AND (uri="*pae_global_block*" OR post_type="*private*" OR post_status="*draft*")