RomethemeKit For Elementor Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the RomethemeKit For Elementor plugin for WordPress, affecting all versions through 1.5.2. The issue arises in the register_controls function within widgets/offcanvas-rometheme.php, where authenticated attackers with Contributor-level access or higher can access private, pending, and draft template data.

Impact

Exploitation of this vulnerability allows authenticated users with Contributor-level access and above to access sensitive template data, including private, pending, and draft items.

Remediation

Users are advised to update the RomethemeKit For Elementor plugin to version 1.5.3 or a newer patched version.