The Restaurant & Cafe Addon for Elementor plugin suffers from an authorization bypass vulnerability (CWE-639) in all versions up to 1.5.9. The issue arises because the 'narestaurant_elementor_template' shortcode does not properly restrict which posts can be included, enabling users with Contributor or higher privileges to extract data from private or draft Elementor posts they normally cannot access. This vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium impact primarily on confidentiality. No known exploits are reported in the wild, and no official patch or remediation guidance is currently provided by the vendor.

The vulnerability allows unauthorized disclosure of private or draft post content within WordPress sites using the affected plugin. Attackers with Contributor-level access or above can view sensitive information from posts they should not have permission to access. There is no impact on integrity or availability reported. The overall impact is limited to information exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users only. Monitor plugin updates from nicheaddons for a security patch addressing this issue.