CVE-2024-10798

Executive Summary

CVE-2024-10798 is an information exposure vulnerability in the Royal Elementor Addons and Templates WordPress plugin, affecting all versions up to and including 1.7.1003. The flaw resides in the wpr-template shortcode, which lacks sufficient authorization checks on which posts can be included. This allows authenticated attackers with Contributor-level access or higher to extract data from private or draft posts created via Elementor that they should not have access to. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of private/draft posts)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for low-privileged users to leak sensitive content from private posts could lead to data breaches in multi-tenant WordPress environments.

Deep Dive & Mechanics

The vulnerability exists in the wpr-template shortcode handler within the Royal Elementor Addons plugin. The shortcode is designed to embed Elementor templates (posts of type elementor_library) into pages or posts. However, the code does not properly verify the post status or the user's permissions before rendering the template content.

Root Cause: The shortcode implementation uses get_post() or similar functions without checking if the target post is published or if the current user has the read_private_posts capability. This allows an authenticated user with Contributor-level access (who can normally only edit their own posts) to supply a post ID or slug pointing to a private or draft Elementor template and have its content rendered.

Attack Flow:

1. An attacker with Contributor-level access logs into WordPress.
2. The attacker crafts a shortcode like [wpr-template id="123"] where 123 is the ID of a private/draft Elementor template.
3. The shortcode is placed in a post or page the attacker can edit (e.g., a new post).
4. When the page is viewed, the plugin renders the private template content, exposing it to the attacker.

Impact: Sensitive information contained in private Elementor templates (e.g., internal notes, draft content, confidential data) can be leaked to unauthorized users.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is described below.

Vulnerable Code (Conceptual):

// In shortcode handler for wpr-template
function wpr_template_shortcode($atts) {
    $id = $atts['id'];
    $post = get_post($id);
    // No permission check or post status verification
    if ($post && $post->post_type == 'elementor_library') {
        return Elementor\Plugin::instance()->frontend->get_builder_content_for_display($id);
    }
    return '';
}

Patched Code (Recommended):

function wpr_template_shortcode($atts) {
    $id = $atts['id'];
    $post = get_post($id);
    // Check post status and user capability
    if ($post && $post->post_type == 'elementor_library' && 
        ($post->post_status == 'publish' || current_user_can('read_private_posts'))) {
        return Elementor\Plugin::instance()->frontend->get_builder_content_for_display($id);
    }
    return '';
}

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites:

• WordPress instance with Royal Elementor Addons <= 1.7.1003
• User account with Contributor-level access
• A private or draft Elementor template (post ID known)

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post or page.
3. Insert the shortcode: [wpr-template id="TARGET_POST_ID"]
4. Publish or preview the post.
5. The private/draft template content will be rendered in the page output.

Example Request (using curl):

curl -X POST 'https://target-site/wp-login.php' -d 'log=contributor&pwd=password'
curl -c cookies.txt -b cookies.txt 'https://target-site/wp-admin/post-new.php'
# Craft a post with the shortcode and submit

Blue Team (Detection & Hardening)

Detection:

• Monitor for shortcode usage in post content by low-privileged users.
• Look for wpr-template shortcode parameters containing numeric IDs that do not correspond to published templates.
• Audit logs for get_post() calls with non-public post statuses.

Hardening:

• Apply the principle of least privilege: restrict Contributor roles from using shortcodes that can access arbitrary posts.
• Use a Web Application Firewall (WAF) rule to block requests containing wpr-template shortcode with suspicious IDs.
• Monitor for unauthorized access to private/draft posts via plugin logs.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/royal-elementor-addons/ (presence of vulnerable version)
• Log Entry: Shortcode [wpr-template id="..."] in post content by non-admin users
• Network: HTTP requests to /wp-admin/post-new.php followed by shortcode injection
• Database: Posts containing wpr-template shortcode with IDs referencing non-public posts

Detection Engineering

YARA Rule

rule CVE_2024_10798_WordPress_Royal_Elementor_Addons
{
    meta:
        description = "Detects vulnerable shortcode usage in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10798"
    strings:
        $shortcode = /\[wpr-template\s+id\s*=\s*["']?\d+["']?\s*\]/ nocase
        $plugin_path = "royal-elementor-addons"
    condition:
        $shortcode and $plugin_path
}

Sigma Rule

title: CVE-2024-10798 - Royal Elementor Addons Information Exposure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-10798 via shortcode injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'wpr-template'
        cs-uri-query|re: 'id=\d+'
    condition: selection
falsepositives:
    - Legitimate use by administrators
level: medium
tags:
    - attack.initial_access
    - cve.2024.10798

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10798 - Royal Elementor Addons Information Exposure"; flow:to_server,established; content:"wpr-template"; http_uri; pcre:"/wpr-template\s+id\s*=\s*\d+/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict its usage to trusted administrators only.
2. Remove Contributor-level access from users who do not require it.
3. Manually patch the shortcode handler as described in the "Vulnerable vs. Patched Code" section.

Long-term Fix:

• Monitor the plugin vendor for an official patch and apply it as soon as available.
• Implement a WordPress security plugin that enforces capability checks on shortcodes.
• Regularly audit user roles and permissions.

Workaround:

• Use a custom function to override the shortcode and add permission checks:

add_shortcode('wpr-template', function($atts) {
    $id = $atts['id'];
    $post = get_post($id);
    if ($post && $post->post_type == 'elementor_library' && 
        ($post->post_status == 'publish' || current_user_can('read_private_posts'))) {
        return Elementor\Plugin::instance()->frontend->get_builder_content_for_display($id);
    }
    return '';
});

Valters IT
Securing Digital Frontiers