WordPress Plugin Vulnerabilities

ElementInvader Addons for Elementor < 1.3.2 - Missing Authorization to Arbitrary Options Read

Description

The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the eli_option_value shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract arbitrary options from the wp_options table.

Affects Plugins

Plugin icon
elementinvader-addons-for-elementor
Fixed in 1.3.2

References

CVE
CVE-2024-12059
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7ec469-70b7-4ec2-83df-c788c76730b4

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Francesco Carlucci
Verified
No
WPVDB ID
fad7d3ab-4f20-47fc-bf6a-6c0b453be1e9

Timeline

Publicly Published
2024-12-11 (about 1 year ago)
Added
2024-12-11 (about 1 year ago)
Last Updated
2024-12-12 (about 1 year ago)

Other

Published
Title
Published
2023-06-12
Title
Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API
Published
2025-07-25
Title
MinimogWP < 3.9.1 - Unauthenticated Price Manipulation
Published
2024-04-16
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.6 - Insecure Direct Object Reference
Published
2025-06-05
Title
Password Policy Manager < 2.0.5 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Published
2025-03-31
Title
WPCargo Track & Trace <= 8.0.2 - Contributor+ Insecure Direct Object Reference