BWD Elementor Addons Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in the BWD Elementor Addons plugin for WordPress, affecting all versions through 4.3.18. The issue is located in the 'widgets/bwdeb-content-switcher.php' file, where authenticated attackers with Contributor-level access and above can access private, pending, and draft template data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive template data, including private, pending, and draft items.

Reproduction

To reproduce this vulnerability, an authenticated user with Contributor-level access or higher can use the BWD Elementor Addons plugin. The vulnerability can be triggered by accessing the content switcher widget, which will expose the sensitive template data from the user's account.

Remediation

Users are advised to update the BWD Elementor Addons plugin to version 4.3.19 or later.