The BWD Elementor Addons plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in the bwdeb-content-switcher.php widget. Authenticated attackers with Contributor-level privileges or above can extract private, pending, and draft template data that should not be accessible to them. This vulnerability affects all versions up to and including 4.3.18. The CVSS 3.1 base score is 4.3, reflecting a low complexity attack vector requiring privileges but no user interaction. There is no indication of known exploits in the wild or an official patch available at this time.

An attacker with Contributor-level or higher access can view sensitive template data that is intended to remain private or in draft status. This exposure could lead to unauthorized disclosure of confidential content or design elements within the WordPress site. The vulnerability does not affect system integrity or availability, nor does it allow privilege escalation beyond the existing Contributor-level access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider limiting plugin usage or disabling the vulnerable widget if possible. Monitor vendor communications for updates on patches or official mitigations.