CVE-2024-8910

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-8910", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2024-09-16T20:19:07.057Z", "datePublished": "2024-09-25T06:48:59.659Z", "dateUpdated": "2026-04-08T16:34:34.405Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:34.405Z"}, "affected": [{"vendor": "devitemsllc", "product": "HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.6.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HT Mega \u2013 Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.5 via the render function in includes/widgets/htmega_accordion.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data."}], "title": "HT Mega \u2013 Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/09fb88e4-4846-40d3-8a79-a6a867bfb59f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3156058/ht-mega-for-elementor"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1230 Exposure of Sensitive Information Through Metadata", "cweId": "CWE-1230", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ankit Patel"}], "timeline": [{"time": "2024-09-17T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2024-09-24T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-25T13:10:43.141102Z", "id": "CVE-2024-8910", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-25T13:26:21.429Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8910", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-25T13:10:43.141102Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-25T13:26:17.814Z"}}], "cna": {"title": "HT Mega \u2013 Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id", "credits": [{"lang": "en", "type": "finder", "value": "Ankit Patel"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "devitemsllc", "product": "HT Mega \u2013 Absolute Addons For Elementor", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.6.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-09-17T00:00:00.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2024-09-24T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/09fb88e4-4846-40d3-8a79-a6a867bfb59f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3156058/ht-mega-for-elementor"}], "descriptions": [{"lang": "en", "value": "The HT Mega \u2013 Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.5 via the render function in includes/widgets/htmega_accordion.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1230", "description": "CWE-1230 Exposure of Sensitive Information Through Metadata"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2024-09-25T06:48:59.659Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8910", "state": "PUBLISHED", "dateUpdated": "2024-09-25T13:26:21.429Z", "dateReserved": "2024-09-16T20:19:07.057Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2024-09-25T06:48:59.659Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder", "vendor": "devitemsllc", "versions": [{"lessThanOrEqual": "2.6.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hasthemes:ht_mega:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "064A0787-280F-46C9-81E7-FF9A10C7257E", "versionEndExcluding": "2.6.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HT Mega \u2013 Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.5 via the render function in includes/widgets/htmega_accordion.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data."}, {"lang": "es", "value": "El complemento HT Mega \u2013 Absolute Addons For Elementor para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n confidencial en todas las versiones hasta la 2.6.5 incluida a trav\u00e9s de la funci\u00f3n de renderizado en features/widgets/htmega_accordion.php. Esto permite que atacantes autenticados, con acceso de nivel de colaborador y superior, extraigan datos confidenciales de plantillas privadas, pendientes y en borrador."}], "id": "CVE-2024-8910", "lastModified": "2026-06-17T08:23:32.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-8910", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-25T13:10:43.141102Z", "version": "2.0.3"}}]}, "published": "2024-09-25T07:15:04.123", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3156058/ht-mega-for-elementor"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/09fb88e4-4846-40d3-8a79-a6a867bfb59f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1230"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}