CVE-2024-10312

Name of the Vulnerable Software and Affected Versions Exclusive Addons for Elementor versions up to, and including, 2.7.4

Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template data via the render function in elements/tabs/tabs.php. This makes it possible for attackers to access sensitive information.

Recommendations For versions up to, and including, 2.7.4, update to the latest version immediately to mitigate risks. As a temporary workaround, consider restricting access to the render function in elements/tabs/tabs.php until a patch is available.