The Enter Addons – Ultimate Template Builder for Elementor plugin suffers from an authorization bypass vulnerability (CWE-639) in its Advanced Tabs widget. Authenticated users with Contributor or higher privileges can exploit insufficient access controls to retrieve information from private or draft posts created by Elementor that they are not authorized to access. This vulnerability affects all plugin versions up to and including 2.1.9. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low attack complexity and requiring low privileges but no user interaction. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor.

An attacker with Contributor-level or higher access can expose content from private or draft Elementor posts that should be restricted, leading to unauthorized information disclosure. There is no impact on integrity or availability reported. The confidentiality impact is limited to data exposure without further system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for any suspicious activity related to the Advanced Tabs widget. Avoid using the affected widget with untrusted users if possible.