CVE-2024-10787

Executive Summary

CVE-2024-10787 is an information exposure vulnerability in the LA-Studio Element Kit for Elementor WordPress plugin, affecting all versions up to and including 1.4.4. The flaw resides in the elementor-template shortcode, which fails to properly restrict which posts can be included. This allows authenticated attackers with Contributor-level access or higher to extract data from private and draft posts created by Elementor that they should not have access to. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch details are available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from the vendor (La-studio) and apply patches as soon as they become available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the low privileges required and the potential to leak sensitive content from private/draft posts. However, the low EPSS score suggests limited active exploitation.

Deep Dive & Mechanics

The vulnerability exists in the elementor-template shortcode provided by the LA-Studio Element Kit plugin. This shortcode is intended to allow embedding Elementor templates into posts or pages. However, the plugin does not properly validate whether the referenced post (template) is in a public, private, or draft status. As a result, an authenticated user with Contributor-level access (who can create and edit posts) can craft a request using the shortcode to include private or draft posts that they would normally not be able to view.

The root cause is a lack of authorization checks in the shortcode handler. The plugin likely uses get_post() or similar functions without verifying the post status or the user's capabilities. This allows an attacker to enumerate and extract content from posts that are not intended to be publicly accessible.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable shortcode handler likely looks like:

// Vulnerable code (conceptual)
add_shortcode('elementor-template', function($atts) {
    $atts = shortcode_atts(array('id' => 0), $atts);
    $post = get_post($atts['id']);
    if ($post) {
        return Elementor\Plugin::instance()->frontend->get_builder_content($post->ID);
    }
    return '';
});

A patched version would include a capability check:

// Patched code (conceptual)
add_shortcode('elementor-template', function($atts) {
    $atts = shortcode_atts(array('id' => 0), $atts);
    $post = get_post($atts['id']);
    if ($post && current_user_can('read_post', $post->ID)) {
        return Elementor\Plugin::instance()->frontend->get_builder_content($post->ID);
    }
    return '';
});

The patch adds a current_user_can('read_post', $post->ID) check to ensure the user has permission to read the specific post.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker with Contributor-level access can:

1. Log in to the WordPress site with a Contributor account.
2. Create a new post or page and insert the [elementor-template id="X"] shortcode, where X is the ID of a private or draft post.
3. Preview or publish the post to see the content of the private/draft post.

Example shortcode usage:

[elementor-template id="123"]

The attacker can enumerate post IDs by brute-forcing or using other information disclosure techniques. The extracted content may include sensitive data such as unpublished articles, internal notes, or draft configurations.

Blue Team

To detect exploitation attempts:

1. Monitor for unusual shortcode usage in post content, especially [elementor-template] with varying IDs.
2. Log and alert on access to private/draft posts by users who should not have permission.
3. Review user activity logs for Contributor-level users creating posts with shortcodes referencing non-public posts.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing [elementor-template id= in the request body or parameters.
• Host: WordPress database entries in wp_posts where post_content contains [elementor-template id= and the referenced post ID is not public.
• Logs: Access logs showing Contributor users viewing private/draft posts via the shortcode.

Detection Engineering

YARA Rule

rule CVE_2024_10787_WordPress_LA_Studio_Element_Kit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-10787 in LA-Studio Element Kit"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10787"
    strings:
        $shortcode = /\[elementor-template\s+id\s*=\s*["']?\d+["']?\]/ nocase
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2024-10787 - LA-Studio Element Kit Information Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects use of elementor-template shortcode to access private/draft posts
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: 'elementor-template'
    condition: selection
falsepositives:
    - Legitimate use of the shortcode by authorized users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10787 - LA-Studio Element Kit Information Exposure Attempt"; flow:to_server,established; content:"elementor-template"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the LA-Studio Element Kit plugin until a patch is available.
2. Short-term: Restrict Contributor-level users from using shortcodes or limit their ability to create posts with shortcodes.
3. Long-term: Apply the vendor patch when released. If no patch is forthcoming, consider replacing the plugin with an alternative.
4. Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing elementor-template in the body. Monitor user activity for anomalous shortcode usage.

Valters IT
Securing Digital Frontiers