CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_fetch. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected posts.
Explanation of Vulnerability in Simple Terms
Royal Addons for Elementor exposes sensitive information to authenticated users with low privileges. An attacker with a basic user account can read data they should not have access to. The vulnerability affects all versions up to 1.3.986. Update to a version newer than 1.3.986 to resolve this issue.
What an attacker can do
Read sensitive information accessible only to higher-privilege users.
Potential impact on your site
User data or site configuration details may be exposed to any registered user account.
Conditions required to exploit
Attacker must have a low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
