CVE-2024-12116: Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.1 - Authenticated (Contributor+) Post Disclosure
Description
The Unlimited Theme Addon For Elementor and WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.1 via the 'uta-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Classification
CVE ID: CVE-2024-12116
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.3
Affected Products
Vendor: codepopular
Product: Unlimited Theme Addon For Elementor and WooCommerce
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 16.22% (scored less or equal to compared to others)
EPSS Date: 2025-02-09 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/9dbdb6cc-2a00-4d34-9c11-62f3d1b51c73?source=cvehttps://wordpress.org/plugins/unlimited-theme-addons/