CVE-2024-8899: 
WordPress vulnerability analysis and mitigation

The Jeg Elementor Kit plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2024-8899) affecting all versions up to and including 2.6.9. The vulnerability exists in the render_content function within class/elements/views/class-tabs-view.php. This security flaw was discovered and reported by Wordfence (Wordfence Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The issue has been classified under CWE-922 (Insecure Storage of Sensitive Information) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The vulnerability allows authenticated attackers with Contributor-level access or higher to extract sensitive private, pending, and draft template data from the WordPress installation. This could lead to unauthorized access to confidential information stored in the system (NVD).

Users are advised to update to version 2.6.10 or later of the Jeg Elementor Kit plugin to address this vulnerability. A patch has been made available through the WordPress plugin repository (WordPress Patch).