CVE-2024-9540 - Sina Extension for Elementor <= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template

Back Back to CVE browser

MEDIUM

Sina Extension for Elementor <= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template

Published Oct 16, 2024

4.3

MEDIUM

CVSS 3.1

EPSS 0.40%

Description

The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.7 via the render function in widgets/advanced/sina-modal-box.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.

Affected products

Vendor Shaonsina Product n/a Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=3.5.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Shaonsina

n/a

unaffected

Version	Status	Constraints
-	affected	<=3.5.7

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49999		Advisory
https://plugins.trac.wordpress.org/changeset/3167197/sina-extension-for-elementor		Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8659e1-5880-4738-99ed-e671449c6878?source=cve		Third Party Advisory