CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Explanation of Vulnerability in Simple Terms
Royal Addons for Elementor contains an authorization flaw that allows authenticated users with low privileges to access sensitive information they should not see. The vulnerability affects all versions up to 1.7.1003. An attacker needs a valid user account to exploit it. Site administrators should update to a version newer than 1.7.1003 when available.
What an attacker can do
Read sensitive data they don't have permission to access.
Potential impact on your site
Unauthorized users can view confidential information stored in the plugin.
Conditions required to exploit
Valid user account with low-level privileges; network access to the site.
Key dates
External resources
Related vulnerabilities
