ElementsKit Elementor Addons WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in the ElementsKit Elementor Addons plugin for WordPress, in all versions through 3.4.0. The issue arises from inadequate capability checks in the 'get_megamenu_content()' function, enabling unauthenticated attackers to access any Elementor-created items, including posts, pages, templates, drafts, trashed, and private items.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, allowing attackers to view private or unpublished content created with Elementor.

Remediation

Users can update to version 3.4.1 or a newer patched version to address this vulnerability.