HT Mega Addons for Elementor Unauthenticated PII Disclosure Vulnerability

A vulnerability in the HT Mega Addons for Elementor WordPress plugin, affecting versions prior to 3.0.7, allows for the unauthenticated disclosure of personally identifiable information (PII). The vulnerability arises from an AJAX action that exposes PII, such as full names, cities, states, and countries, of customers who placed orders in the last seven days.

Impact

Exploitation of this vulnerability leads to the unauthorized exposure of sensitive customer information, including full names and location details.

Reproduction

To reproduce this vulnerability, access the source of any frontend page to find the 'wcsales_purchased_products' AJAX action. Retrieve the security nonce associated with this action, then send a request to 'wp-admin/admin-ajax.php' with the action and nonce included. This will trigger the PII disclosure.

Remediation

Users are advised to update the HT Mega Addons for Elementor WordPress plugin to version 3.0.7 or later.