CVE-2024-9542

Name of the Vulnerable Software and Affected Versions The Sky Addons for Elementor plugin for WordPress versions up to, and including, 2.6.1

Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft Elementor template data. This is possible due to the render function in modules/content-switcher/widgets/content-switcher.php.

Recommendations For versions up to, and including, 2.6.1, update to a version later than 2.6.1 to resolve the issue. As a temporary workaround, consider restricting access to the render function in modules/content-switcher/widgets/content-switcher.php to minimize the risk of exploitation.