The UltraAddons for Elementor plugin suffers from an authorization bypass vulnerability (CWE-639) caused by insufficient validation of a user-controlled key in the show_template feature. This allows authenticated users with Contributor or higher privileges to bypass access controls and expose content of draft, private, and pending posts. The vulnerability affects all versions up to and including 1.1.8. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. No patch or vendor advisory has been provided to date.

An attacker with Contributor-level access or above can exploit this vulnerability to gain unauthorized read access to draft, private, and pending posts within the WordPress site using the UltraAddons plugin. This leads to confidentiality loss of unpublished or restricted content. There is no indication of impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only. Monitor for updates from the plugin vendor or WordPress security channels for an official patch or mitigation instructions.