2 lines
2.6 KiB
JSON
2 lines
2.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Royal Addons for Elementor – Addons and Templates Kit for Elementor","vendor":"wproyal","versions":[{"lessThanOrEqual":"1.7.1049","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get_main_query_args() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract contents of non-public custom post types, such as Contact Form 7 submissions or WooCommerce coupons."},{"lang":"es","value":"El plugin Royal Addons for Elementor – Addons and Templates Kit for Elementor para WordPress es vulnerable a la exposición de información en todas las versiones hasta la 1.7.1049, inclusive, a través de la función get_main_query_args() debido a restricciones insuficientes sobre qué publicaciones pueden incluirse. Esto hace posible que atacantes no autenticados extraigan el contenido de tipos de publicaciones personalizadas no públicas, como envíos de Contact Form 7 o cupones de WooCommerce."}],"id":"CVE-2026-2373","lastModified":"2026-06-17T10:30:51.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-2373","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-17T13:25:07.262434Z","version":"2.0.3"}}]},"published":"2026-03-17T04:16:14.730","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3475656/"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4192a7f-b962-46f9-a524-7271ed6f4917?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@wordfence.com","type":"Secondary"}]}
|