CVE-2024-4205: 
WordPress vulnerability analysis and mitigation

The Premium Addons for Elementor plugin for WordPress (CVE-2024-4205) contains a vulnerability related to unauthorized access of data, discovered and reported by Thura Moe Myint. The vulnerability affects all versions up to and including 4.10.31, and was publicly disclosed on May 31, 2024. The issue stems from a missing capability check in the get_template_content() function (NVD).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 Base Score of 4.3 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and required low privileges (NVD).

The vulnerability allows authenticated attackers with subscriber-level access or higher to retrieve Elementor template data, potentially exposing sensitive template information (NVD).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. The attack can be executed remotely with low complexity (NVD).

Users should upgrade to version 4.10.32 or later which contains the fix for this vulnerability. A patch has been released and is available through the WordPress plugin repository (Wordpress Patch).