WordPress Plugin Vulnerabilities

Restrict for Elementor < 1.0.8 - Protection Mechanism Bypass

Description

The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 due to improper restrictions on hidden data that make it accessible through the REST API. This makes it possible for unauthenticated attackers to extract potentially sensitive data from post content.

Affects Plugins

Plugin icon
restrict-for-elementor
Fixed in 1.0.8

References

CVE
CVE-2024-0910
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/14993c04-7fe3-4c42-a605-2e431df14d79

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Francesco Carlucci
Verified
No
WPVDB ID
a4cfe0aa-a00c-48a3-9df9-503e6c8eb274

Timeline

Publicly Published
2024-06-05 (about 2 years ago)
Added
2024-06-05 (about 2 years ago)
Last Updated
2024-07-02 (about 2 years ago)

Other

Published
Title
Published
2025-04-04
Title
Online Booking & Scheduling Calendar for WordPress by vcita < 4.6.0 - Authenticated (Subscriber+) Sensitive Information Exposure
Published
2026-01-24
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.28 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php
Published
2025-11-10
Title
Authors List < 2.0.6.2 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode
Published
2026-07-29
Title
Kadence Blocks < 3.7.8.1 - Contributor+ Information Exposure
Published
2026-01-22
Title
Contact Form 7 GetResponse Extension < 1.1.0 - Unauthenticated Information Exposure