What the vulnerability does
01Description
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.8 the 'register_user' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Edit Login | Registration Form widget, as long as that user opens the email notification for successful registration.
Explanation of Vulnerability in Simple Terms
02Summary
Responsive Addons for Elementor versions up to 1.6.8 expose sensitive information to authenticated users. A logged-in user who visits a malicious link can view data they should not have access to. The vulnerability requires user interaction and affects confidentiality only. Update to a version newer than 1.6.8.
What an attacker can do
03Attacker Capabilities
View sensitive information they should not have access to by tricking a logged-in user into visiting a malicious link.
Potential impact on your site
04Site Impact
Authenticated users' sensitive data may be exposed if they visit attacker-controlled links while logged into your site.
Conditions required to exploit
05Prerequisites
Attacker needs a valid user account on the site; victim must click a malicious link while logged in.
Key dates
06Disclosure timeline
March 26, 2025
CVE published
April 8, 2026
Record updated
