DethemeKit For Elementor Information Exposure Vulnerability

A vulnerability allowing information exposure has been identified in the DethemeKit For Elementor plugin for WordPress, affecting all versions through 2.1.8. The issue arises in the duplicate_post() function, where inadequate restrictions allow authenticated attackers with Contributor-level access and above to duplicate posts and access data from password-protected, private, draft, or scheduled posts that should otherwise be restricted.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive post data, including information from password-protected, private, draft, or scheduled posts.

Remediation

Users are advised to update the DethemeKit For Elementor plugin to version 2.1.9 or a newer patched version.