The SKT Addons for Elementor plugin for WordPress contains an authorization bypass vulnerability (CWE-639) in its Unfold widget. This flaw allows authenticated users with Contributor-level permissions or above to bypass intended access controls and extract data from private or draft posts created by Elementor. The issue exists in all versions up to and including 3.3 due to insufficient restrictions on which posts can be included by the widget. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but resulting in limited confidentiality impact.

An attacker with Contributor-level access or higher can access private or draft post content that should be restricted, leading to unauthorized information disclosure. There is no impact on integrity or availability reported. The exposure is limited to data within the WordPress environment where the vulnerable plugin is installed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Unfold widget in the SKT Addons for Elementor plugin. Monitor for vendor updates regarding an official patch.