CVE-2024-10797

Executive Summary

CVE-2024-10797 is an information exposure vulnerability in the Full Screen Menu for Elementor WordPress plugin, affecting all versions up to and including 1.0.7. The flaw resides in the plugin’s Elementor widget, which fails to enforce proper authorization checks when including posts. This allows authenticated attackers with contributor-level access or higher to extract data from private or draft posts created with Elementor that they should not have access to. The vulnerability is classified as a CWE-639 (Authorization Bypass Through User-Controlled Key) and carries a CVSS score of 4.3 (Medium). No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and consider disabling the plugin until a patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of private/draft post data)
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the low privileges required and the potential for sensitive content exposure, though the impact is limited to read-only access.

Deep Dive & Mechanics

The vulnerability exists in the full-screen-menu-for-elementor plugin’s Elementor widget, which is used to display a full-screen navigation menu. The widget includes functionality to fetch and display posts (e.g., pages, custom post types) created with Elementor. Due to insufficient restrictions on which posts can be included, the widget does not properly verify the post’s status (e.g., draft, private) or the user’s permissions to view those posts.

An authenticated attacker with contributor-level access can craft a request to the widget’s data retrieval endpoint, manipulating parameters (such as post IDs or query filters) to include private or draft posts. The plugin fails to check if the current user has the read_private_posts capability or if the post status is publish. This leads to unauthorized information disclosure.

The root cause is a missing or insufficient capability check in the widget’s render() or get_data() method, likely in a PHP function that queries posts using WP_Query without applying proper post_status or post__in filters based on user permissions.

Vulnerable vs. Patched Code

Since no patch is available, the following illustrates the vulnerable pattern and a hypothetical fix.

Vulnerable Code (hypothetical):

// In widget class
public function get_posts() {
    $args = array(
        'post_type' => 'any',
        'post__in' => $this->get_settings('selected_posts'),
        'posts_per_page' => -1,
    );
    $query = new WP_Query($args);
    return $query->posts;
}

Patched Code (hypothetical):

public function get_posts() {
    $selected_posts = $this->get_settings('selected_posts');
    if (!empty($selected_posts)) {
        // Ensure only published posts the user can read are included
        $args = array(
            'post_type' => 'any',
            'post__in' => $selected_posts,
            'post_status' => 'publish',
            'posts_per_page' => -1,
        );
        // Additional capability check
        if (!current_user_can('read_private_posts')) {
            $args['post_status'] = 'publish';
        }
        $query = new WP_Query($args);
        return $query->posts;
    }
    return array();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with the Full Screen Menu for Elementor plugin (version <= 1.0.7) installed and activated.
• An authenticated user account with at least Contributor-level privileges.
• At least one private or draft post created with Elementor.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Navigate to a page that uses the Full Screen Menu widget.
3. Using browser developer tools, inspect the AJAX request made by the widget to fetch menu items. Look for parameters like action, post_ids, or selected_posts.
4. Craft a modified request (e.g., using cURL or a tool like Burp Suite) to include the ID of a private or draft post.

   curl -X POST 'https://target.com/wp-admin/admin-ajax.php' \
   -d 'action=full_screen_menu_get_posts&post_ids[]=123' \
   --cookie 'wordpress_logged_in_...=...'
   

5. The response will contain the content of the private/draft post, including title, excerpt, and possibly full content.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions related to the Full Screen Menu plugin (e.g., full_screen_menu_get_posts).
• Look for requests from contributor-level users that include multiple post IDs or attempt to access posts with non-public statuses.
• Enable logging of all WP_Query calls and review for queries that bypass post_status filters.

Hunting:

• Search for instances where a user with role contributor or author retrieves posts with status draft or private.
• Review plugin logs (if available) for unauthorized post access attempts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /wp-admin/admin-ajax.php with parameters containing action=full_screen_menu_get_posts and post_ids[] values.
  • Responses containing post content (title, body) for posts with status draft or private.
• Host:
  • WordPress debug log entries showing WP_Query calls with post_status not set to publish for non-admin users.
  • Unusual database queries in the MySQL slow query log that select from wp_posts where post_status is not publish and post_author does not match the current user.

Detection Engineering

YARA Rule

rule Detect_Full_Screen_Menu_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-10797 in WordPress Full Screen Menu plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10797"
    strings:
        $ajax_action = "full_screen_menu_get_posts"
        $post_ids = "post_ids[]"
        $wp_admin_ajax = "/wp-admin/admin-ajax.php"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-10797 - Full Screen Menu for Elementor Information Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit information exposure in Full Screen Menu for Elementor plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=full_screen_menu_get_posts'
        cs-uri-query|contains: 'post_ids[]'
    condition: selection
falsepositives:
    - Legitimate use by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10797 - Full Screen Menu for Elementor Information Exposure Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=full_screen_menu_get_posts";
    http_client_body;
    content:"post_ids[]";
    http_client_body;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2024-10797;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. If disabling is not possible, restrict access to the plugin’s functionality by modifying the widget’s PHP code to add capability checks (see patched code example).
3. Implement a Web Application Firewall (WAF) rule to block requests containing action=full_screen_menu_get_posts from non-admin users.

Long-term:

• Monitor the plugin’s update channel for a security patch.
• Consider replacing the plugin with an alternative that has active security maintenance.
• Enforce the principle of least privilege: ensure contributor-level users do not have access to private/draft posts unless explicitly required.

Vendor Contact: Detheme (via WordPress plugin repository) – no patch available as of this report.

Valters IT