Elementor Website Builder Incorrect Authorization Vulnerability Allowing Sensitive Information Exposure

A vulnerability exists in the Elementor Website Builder plugin for WordPress, in all versions through 3.35.7. The issue stems from a logic error in the permission check of the 'is_allowed_to_read_template()' function. This error allows authenticated users with contributor-level access and above to read private or draft Elementor templates. The vulnerability arises because non-published templates are incorrectly treated as readable, without proper verification of editing capabilities. Exploitation can be achieved by supplying a 'template_id' to the 'get_template_data' action of the 'elementor_ajax' endpoint.

Impact

Exploitation of this vulnerability allows for unauthorized access to private or draft Elementor template content, creating a risk of sensitive information exposure.

Remediation

Users are advised to update the Elementor Website Builder plugin to version 3.35.8 or a newer patched version.