Prime Addons for Elementor Insecure Direct Object Reference Vulnerability

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Prime Addons for Elementor plugin for WordPress, affecting all versions through 2.0.1. The vulnerability arises from missing validation on a user-controlled key in the 'pae_global_block' shortcode. This flaw enables authenticated attackers with Contributor-level access and above to access and extract information from non-public posts, including drafts, private, password-protected, and restricted content. The issue specifically pertains to posts created with Elementor.

Impact

Exploitation of this vulnerability allows for unauthorized access to and extraction of information from non-public posts, including drafts, private, password-protected, and restricted content, created with Elementor.

Remediation

Users are advised to update the Prime Addons for Elementor plugin to version 2.0.2 or a newer patched version.