CVE-2024-12532: BWD Elementor Addons <= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
Description
The BWD Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.18 in widgets/bwdeb-content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Classification
CVE ID: CVE-2024-12532
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.3
Affected Products
Vendor: bestwpdeveloper
Product: BWD Elementor Addons (2500+ presets, Meet The Team, Lottie, Lord Icon, Masking, Woocommerce, Theme Builder, Products, Blogs, CV, Contact Form 7 Styler, Header, Slider, Hero Section)
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 16.22% (scored less or equal to compared to others)
EPSS Date: 2025-02-05 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/8bdf6a52-7316-440b-9d36-d405a672dce1?source=cvehttps://plugins.trac.wordpress.org/changeset/3211460/bwd-elementor-addons