What the vulnerability does
01Description
The Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via the 'bse-elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created with Elementor that they should not have access to.
Explanation of Vulnerability in Simple Terms
02Summary
Builder Shortcode Extras allows authenticated users with low privileges to read sensitive data from the site. The plugin does not properly restrict access to certain functions, enabling a logged-in user to view information they should not have access to. This affects all versions up to and including 1.0.0. Update to a version newer than 1.0.0 when available.
What an attacker can do
03Attacker Capabilities
Read sensitive site data as a low-privilege authenticated user.
Potential impact on your site
04Site Impact
Low-privilege users can access confidential information they shouldn't see, risking data exposure.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
February 7, 2025
CVE published
April 8, 2026
Record updated
