Elementor Addon Elements < 1.12.8 - Unauthenticated Post ID/Tile Disclosure

2023-11-1600:00:00

wpscan.com

plugin ajax_eae_post_data function unauthenticated users arbitrary posts pages draft private ids tiles

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

28.6%

JSON

Description The plugin does not have authorisation in its ajax_eae_post_data function, allowing unauthenticated users to retrieve arbitrary posts/pages (such as draft, private etc) IDs and tiles