The HT Event – WordPress Event Manager Plugin for Elementor contains a sensitive information exposure vulnerability (CWE-359) in its 'render' function located in /includes/widgets/htevent_sponsor.php. Authenticated attackers with Contributor-level privileges or above can exploit this flaw to extract private and unpublished template data. The vulnerability affects all versions up to and including 1.4.7. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and limited confidentiality impact.

An attacker with Contributor-level access or higher can access sensitive private and unpublished event template data that should not be exposed. This compromises confidentiality of private personal information managed by the plugin. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix links are provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict Contributor-level access to trusted users only to reduce risk of exploitation.