What’s Vulnerable › Vulnerabilities

CVE-2024-6455: ElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Function

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-18 · updated 2026-06-17
• Weakness: CWE-200

Description

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capability checks on ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, pending and private items.

Affected products

• roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor: before 3.2.1 — fixed in 3.2.1

How to fix

Upgrade to a fixed version: roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor 3.2.1. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.2.0/modules/controls/widget-area-utils.php#L15
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7c336530-09b2-4ead-923f-f1a6266e3e8e?source=cve
• https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.2.0/modules/controls/widget-area-utils.php#L15
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7c336530-09b2-4ead-923f-f1a6266e3e8e?source=cve

Get alerted when CVE-2024-6455 or the next vulnerability affects your stack