The Xpro Addons — 140+ Widgets for Elementor WordPress plugin contains a sensitive information exposure vulnerability (CWE-200) identified as CVE-2024-12584. Authenticated users with Contributor-level permissions or above can use the 'duplicate' function to extract sensitive data from posts that are not publicly visible, including drafts, scheduled posts, private posts, and password-protected posts. The vulnerability affects all versions up to and including 1.4.6.2. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. There is no vendor advisory or patch information provided, and the product is not a cloud service.

An attacker with Contributor-level access or higher can access sensitive content from non-public posts, potentially leading to unauthorized disclosure of information. The vulnerability does not affect data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the 'duplicate' function. Avoid granting unnecessary permissions to users who do not require them.