The ElementInvader Addons for Elementor plugin contains an authorization bypass vulnerability (CWE-639) that permits authenticated users with Contributor or higher privileges to leverage the eli_option_value shortcode to retrieve arbitrary option values from the WordPress wp_options table. This exposure of sensitive information occurs because the plugin does not properly restrict access to these options based on user permissions. The vulnerability affects all versions up to and including 1.3.1. The CVSS v3.1 base score is 4.3, indicating a medium severity with network attack vector, low complexity, and requiring low privileges but no user interaction.

An attacker with Contributor-level or higher access can extract sensitive configuration or option data from the WordPress database, potentially exposing information that should be restricted. This could lead to information disclosure but does not directly impact integrity or availability. There are no known exploits in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the ElementInvader Addons for Elementor plugin if sensitive information exposure risk is unacceptable.