The PowerPack Elementor Addons plugin for WordPress suffers from an information exposure vulnerability (CWE-639) in all versions up to 2.8.1. Authenticated users with Contributor or higher privileges can exploit insufficient access controls in the Content Reveal widget to access content from posts that are password protected, private, or in draft status. This results in unauthorized disclosure of sensitive post data. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and limited impact confined to confidentiality. No official patch or remediation details have been provided yet.

The vulnerability allows unauthorized read access to restricted post content for authenticated users with Contributor-level permissions or above. This could lead to leakage of sensitive or confidential information stored in protected posts. There is no impact on integrity or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access carefully and monitor user privileges to limit exposure. Avoid using the vulnerable Content Reveal widget with sensitive content. Follow updates from the vendor ideaboxcreations for patch availability.