CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the render function in modules/content-switcher/widgets/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
Explanation of Vulnerability in Simple Terms
Sky Addons for Elementor contains an information exposure vulnerability in versions up to 2.6.1. A logged-in user with low privileges can access sensitive data that should be restricted. The vulnerability requires network access and valid user credentials but no additional user interaction. Site administrators should update to a version newer than 2.6.1.
What an attacker can do
Read sensitive information accessible through the plugin that should be restricted from their user role.
Potential impact on your site
Unauthorized users can view restricted data depending on their role and the plugin's data exposure scope.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
