Elementor Website Builder Pro Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in the Elementor Website Builder Pro plugin for WordPress, affecting all versions through 3.25.10. The issue arises from the 'elementor-template' shortcode, which authenticated attackers with Contributor-level access and above can exploit to access sensitive data. This includes the content of Private, Pending, and Draft Templates. Although version 3.24.4 partially addressed this vulnerability, it remains a concern in the subsequent release.

Impact

Exploitation of this vulnerability allows authenticated users with Contributor-level access and above to access sensitive template data, including Private, Pending, and Draft Templates.

Remediation

Users can update to version 3.25.11 or a newer patched version to address this vulnerability.