What the vulnerability does
01Description
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tp_carousel_anything.php, modules/widgets/tp_page_scroll.php, and other widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Explanation of Vulnerability in Simple Terms
02Summary
The Plus Addons for Elementor plugin for WordPress exposes sensitive information to authenticated users with low privileges. An attacker with a basic user account can access data they should not be able to view. The vulnerability affects versions up to 6.0.3. Update to a version newer than 6.0.3 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive information accessible only to higher-privilege users.
Potential impact on your site
04Site Impact
User data or site configuration details may be exposed to low-privilege accounts, compromising privacy.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
November 20, 2024
CVE published
April 8, 2026
Record updated
