The Prime Addons for Elementor plugin suffers from an Insecure Direct Object Reference vulnerability due to missing validation on a user-controlled key in the pae_global_block shortcode. This flaw permits authenticated users with Contributor-level privileges or above to retrieve content from posts that should be inaccessible, such as drafts and private posts created with Elementor. The vulnerability affects all versions up to and including 2.0.1. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges but no user interaction, and resulting in limited confidentiality impact.

An attacker with Contributor-level or higher access can exploit this vulnerability to read content from non-public Elementor posts, potentially exposing sensitive or unpublished information. There is no impact on integrity or availability. The exposure is limited to posts created with Elementor and does not extend to other content types or plugins.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the pae_global_block shortcode if possible. Monitor for updates from the plugin vendor regarding an official fix.