CVE-2024-2974: 
WordPress vulnerability analysis and mitigation

The Essential Addons for Elementor WordPress plugin (versions up to and including 5.9.13) contains a Sensitive Information Exposure vulnerability identified as CVE-2024-2974. The vulnerability was discovered by Ankit Patel and publicly disclosed on March 29, 2024. This security issue affects the plugin's load_more function and impacts installations of the Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin (NVD, WPScan).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The security flaw is classified as CWE-922 (Insecure Storage of Sensitive Information) and is related to the plugin's load_more function implementation. The issue allows unauthenticated access to sensitive data through the affected component (Wordfence).

The vulnerability enables unauthenticated attackers to extract sensitive data, including private and draft posts from WordPress installations running the affected plugin versions. This unauthorized access to non-public content could potentially expose confidential information that was intended to remain private (NVD).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit the vulnerability through the load_more function (WPScan).

The vulnerability has been patched in version 5.9.14 of the Essential Addons for Elementor plugin. Users are strongly advised to update to this version or later to protect against potential exploitation (WordPress).