CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 in elements/advanced-tab/template/view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Explanation of Vulnerability in Simple Terms
The All-in-One Addons for Elementor – WidgetKit plugin through version 2.5.5 exposes sensitive information to authenticated users. A logged-in attacker with low privileges can access data they should not be able to view. The vulnerability requires network access but no user interaction. Update to a version newer than 2.5.5 to remediate.
What an attacker can do
Read sensitive information accessible only to higher-privilege users or other site users.
Potential impact on your site
User data or site configuration details may be exposed to low-privilege accounts, risking privacy violations.
Conditions required to exploit
Attacker must be logged in with a low-privilege account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
