CVE-2024-10802 - CVE House

Back to Database

Status published Medium CVE-2024-10802

Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure

5.3 CVSS

Vulnerability Description

The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_id() function in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated attackers to retrieve draft post titles that should not be accessible to unauthenticated users.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-10802

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Francesco Carlucci

References

More from hashthemes

View All →

Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerability

WordPress Easy Elementor Addons Plugin <= 2.2.8 - Local File Inclusion Vulnerability

WordPress Easy Elementor Addons Plugin <= 2.2.7 - Broken Access Control Vulnerability

WordPress Easy Elementor Addons plugin <= 2.2.6 - Cross Site Scripting (XSS) Vulnerability

Affected Vendor

hashthemes

View all reports →

Affected Software

Hash Elements

Vulnerable Versions:

0

Timeline

Official Publish: November 13th, 2024

Last Modified: April 8th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal