Ht Mega Addons For Elementor
Monthly
HT Mega Addons for Elementor WordPress plugin before version 3.0.7 leaks customer PII through an unauthenticated AJAX endpoint, exposing full name, city, state, and country for any orders placed in the prior 7 days. Any remote unauthenticated attacker can query this endpoint without credentials on affected WordPress installations. A public proof-of-concept is available and SSVC classifies the attack as automatable, enabling mass scanning of exposed WooCommerce stores; however, the EPSS score of 0.77% suggests exploitation has not yet become widespread.
HT Mega Addons for Elementor WordPress plugin before version 3.0.7 leaks customer PII through an unauthenticated AJAX endpoint, exposing full name, city, state, and country for any orders placed in the prior 7 days. Any remote unauthenticated attacker can query this endpoint without credentials on affected WordPress installations. A public proof-of-concept is available and SSVC classifies the attack as automatable, enabling mass scanning of exposed WooCommerce stores; however, the EPSS score of 0.77% suggests exploitation has not yet become widespread.