The Essential Addons for Elementor plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in versions up to and including 5.9.15. The flaw exists in the ajax_load_more(), eael_woo_pagination_product_ajax(), and ajax_eael_product_gallery() functions, which can be invoked by unauthenticated users to extract posts that are meant to be private or drafts. This vulnerability allows unauthorized disclosure of content without requiring authentication or user interaction. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges required, impacting confidentiality only.

An unauthenticated attacker can retrieve private or draft posts from the affected WordPress plugin, leading to unauthorized disclosure of potentially sensitive content. There is no impact on data integrity or availability. The exposure could compromise confidentiality of unpublished or restricted content managed through the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to AJAX endpoints or disabling the affected plugin features if feasible. Monitor official wpdevteam communications for updates and apply patches promptly once available.