CVE-2024-0910: 
WordPress vulnerability analysis and mitigation

The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.0.6. This vulnerability was discovered and disclosed on June 5, 2024, and affects the WordPress plugin that provides content restriction capabilities for Elementor-powered websites (NVD, WordPress Plugin).

The vulnerability stems from improper restrictions on hidden data that makes it accessible through the REST API. This security flaw has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it can be exploited remotely without requiring privileges or user interaction (NVD).

The vulnerability allows unauthenticated attackers to extract potentially sensitive data from post content that was intended to be restricted. This could lead to unauthorized access to protected information that was meant to be visible only to specific users or roles (NVD).

The vulnerability can be exploited by unauthenticated attackers remotely through the REST API, requiring no special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (NVD).

Users are advised to update to version 1.0.7 or later of the Restrict for Elementor plugin, which includes security measures for the REST API. The update was released as part of version 1.0.9, which also addressed additional security concerns and PHP deprecated function warnings (WordPress Plugin).