The BWD Elementor Addons plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in all versions up to 4.3.18, specifically in the widgets/bwdeb-content-switcher.php file. This flaw permits authenticated attackers with Contributor-level permissions or above to extract sensitive template data that should not be accessible, including private, pending, and draft content. The CVSS 3.1 base score is 4.3, reflecting a low complexity attack vector requiring authentication but resulting only in confidentiality loss without integrity or availability impact.

An attacker with Contributor-level or higher access can view sensitive template data that is intended to remain private, including drafts and pending templates. This exposure compromises confidentiality but does not affect the integrity or availability of the system. There are no reported exploits in the wild, and the vulnerability requires authenticated access, limiting the attack surface to users with some level of trust within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for any suspicious activity related to template data access. Avoid granting Contributor or higher privileges to untrusted users. Follow best practices for WordPress plugin updates and apply any vendor patches promptly once available.