CVE-2024-12099

Description

The Dollie Hub – Build Your Own WordPress Cloud Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.2.0 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.

PUBLISHED Reserved 2024-12-03 | Published 2024-12-04 | Updated 2024-12-04 | Assigner Wordfence

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Timeline

Credits

Francesco Carlucci finder

References

www.wordfence.com/...-20a5-43f2-bf36-660579103220?source=cve

plugins.trac.wordpress.org/...40dollie&sfp_email=&sfph_mail=

cve.org (CVE-2024-12099)

nvd.nist.gov (CVE-2024-12099)

Download JSON