CVE-2024-13215: 
WordPress vulnerability analysis and mitigation

The Elementor Addon Elements plugin for WordPress (CVE-2024-13215) contains a Sensitive Information Exposure vulnerability affecting all versions up to and including 1.13.10. The vulnerability was discovered in January 2025 and impacts the 'render' function in the modal-popup.php file (NVD, WPScan).

The vulnerability exists in the 'render' function located in modules/modal-popup/widgets/modal-popup.php. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) (NVD).

The vulnerability allows authenticated attackers with Contributor-level access or higher to extract sensitive private, pending, scheduled, and draft template data from the WordPress installation (NVD, WPScan).

The vulnerability requires an authenticated user with at least Contributor-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

The vulnerability has been patched in version 1.14 of the Elementor Addon Elements plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).