The Clever Addons for Elementor plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in the getTemplateContent function located in src/widgets/class-clever-widget-base.php. Authenticated attackers with Contributor-level privileges or higher can exploit this flaw to extract private, pending, and draft template data that should not be accessible to them. The vulnerability affects all versions up to and including 2.2.1. The CVSS 3.1 base score is 4.3 (medium), reflecting the network attack vector, low complexity, and limited confidentiality impact without affecting integrity or availability. No patch or official fix has been disclosed as of the publication date.

An attacker with Contributor-level or higher access can retrieve sensitive template data that is intended to remain private, including drafts and pending templates. This unauthorized disclosure could lead to information leakage within the affected WordPress environment. There is no indication of impact on data integrity or system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict Contributor-level access to trusted users only and monitor for any unusual access patterns. Avoid granting Contributor or higher privileges to untrusted users. Stay updated with the vendor's announcements for any forthcoming patches or official mitigations.