Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2024-13854: WordPress Education Addon plugin: Unauthorized post access via shortcode
CVE-2024-13854 · published 1 year ago
Summary
The Education Addon for Elementor plugin for WordPress allows attackers with contributor-level access to view private posts created with Elementor. This is a security risk because it lets attackers see sensitive information that's not meant to be public. Update the plugin to a version higher than 1.3.1 to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| nicheaddons | education_addon |
<= 1.3.1 cpe:2.3:a:nicheaddons:education_addon:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naedu_elementor_template shortcode due t...
The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naedu_elementor_template shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract information from posts that are not public, including drafts, password protected, and restricted posts. This applies to posts created with Elementor only.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-284Improper Access Control
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published19 Feb 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-13854 · NVD
Track software like this
Free during beta