The Element Pack Elementor Addons plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in the element_pack_ajax_search function. This flaw enables unauthenticated attackers to retrieve sensitive data, such as password-protected post details, from affected versions up to 5.5.6. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No known exploits are reported in the wild, and no patch or official fix has been documented yet.

An unauthenticated attacker can extract sensitive information from the affected WordPress plugin, potentially exposing password-protected post details. This could lead to unauthorized disclosure of confidential content. The vulnerability does not affect integrity or availability, only confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the vulnerable plugin functionality, or applying compensating controls to limit exposure. Monitor vendor channels for updates.