CVE-2024-8494: The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the…

PriorityP335medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EPSS

0.30%

21.3th percentile

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'elementor-template' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of Private, Pending, and Draft Templates. The vulnerability was partially patched in version 3.24.4.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
elementor	website_builder	< 3.25.11	3.25.11
https	elementor.com_elementor_website_builder_pro	<= 3.25.10	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.