← Zuruck zu CVEs
CVE-2024-5329
HIGH8.8
Beschreibung
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parameter in all versions up to, and including, 1.5.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE Details
CVSS v3.1 Bewertung8.8
SchweregradHIGH
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienLOW
BenutzerinteraktionNONE
Veroffentlicht6/6/2024
Zuletzt geandert11/21/2024
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
unlimited-elements:unlimited_elements_for_elementor
Schwachen (CWE)
CWE-89
Referenzen
https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php#L999(security@wordfence.com)
https://plugins.trac.wordpress.org/changeset/3097249/#file6(security@wordfence.com)
https://wordpress.org/plugins/unlimited-elements-for-elementor/#developers(security@wordfence.com)
https://www.wordfence.com/threat-intel/vulnerabilities/id/f33d77b7-5412-47bf-9bed-8617151723c9?source=cve(security@wordfence.com)
https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php#L999(af854a3a-2127-422b-91ae-364da2661108)
https://plugins.trac.wordpress.org/changeset/3097249/#file6(af854a3a-2127-422b-91ae-364da2661108)
https://wordpress.org/plugins/unlimited-elements-for-elementor/#developers(af854a3a-2127-422b-91ae-364da2661108)
https://www.wordfence.com/threat-intel/vulnerabilities/id/f33d77b7-5412-47bf-9bed-8617151723c9?source=cve(af854a3a-2127-422b-91ae-364da2661108)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.