Piotnet Addons For Elementor Information Exposure Vulnerability

A vulnerability allowing information exposure exists in the Piotnet Addons For Elementor plugin for WordPress, affecting all versions through 2.4.32. The issue arises from the 'pafe-template' shortcode, which lacks proper restrictions on the posts that can be included. This flaw enables authenticated attackers with Contributor-level access or higher to access and extract data from private or draft posts created with Elementor, which they should not be able to view.

Impact

Exploitation of this vulnerability could lead to unauthorized access to private or draft posts, allowing attackers to disclose information that should remain confidential.

Remediation

Users are advised to update the Piotnet Addons For Elementor plugin to version 2.4.33 or a newer patched version.