UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2024-6757

Elementor Website Builder – more than just a page builder: Exposure of Sensitive Information to an Unauthorized Actor

Severity
Medium 4.3
Published
14 Oct 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.24.6
Also known as
WPV-6e08b143ee6c
Sources
NVD, WPVulnerability

Description

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 3.23.5 via the get_image_alt function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract either excerpt data or titles of private or password-protected posts.

Affected software

SoftwareAffected versions
ElementorServers and applications · cpe:a:elementor:website_builder
  • Every version before 3.24.6
ElementorWordPress plugins · wp-plugin:elementor
  • Every version before 3.24.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-6757
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-6757
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elementor/elementor-3235-authenticated-contributor-basic-information-exposure-via-get-image-alt-function