CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the render_column function in modules/data-table/widgets/data-table.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Explanation of Vulnerability in Simple Terms
Addon Elements for Elementor exposes sensitive information to authenticated users with low privileges. The plugin fails to properly restrict access to certain data, allowing logged-in users to view information they should not have access to. This affects all versions up to 1.13.8. Site administrators should update to a version newer than 1.13.8 when available.
What an attacker can do
View sensitive information accessible only to higher-privileged users.
Potential impact on your site
Unauthorized disclosure of site data to low-privilege users; potential exposure of private content or configuration details.
Conditions required to exploit
Attacker must be logged in to the site with a low-privilege account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
