The Exclusive Addons for Elementor plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in all versions up to 2.7.4. The issue arises from the render function in elements/tabs/tabs.php, which improperly restricts access to private, pending, and draft template data. Authenticated attackers with Contributor-level privileges or above can exploit this flaw to extract sensitive template information that should not be accessible to them. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low complexity, and requiring privileges but no user interaction.

An attacker with Contributor-level or higher access to a WordPress site using the vulnerable plugin can retrieve sensitive template data that is intended to be private, pending, or in draft status. This exposure could lead to unauthorized disclosure of site design or content information. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — no official fix or patch links have been provided by the vendor. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a patch is available, restrict Contributor-level access to trusted users only and consider disabling or removing the plugin if sensitive template data exposure poses a significant risk.