The Premium Addons for Elementor plugin for WordPress suffers from a missing capability check in the get_template_content() function, classified as CWE-862 (Missing Authorization). This flaw allows authenticated attackers with subscriber-level privileges or above to retrieve Elementor template data that should be protected. The vulnerability is present in all versions up to 4.10.31. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low complexity, and limited impact on confidentiality only. No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

An attacker with subscriber-level access or higher can retrieve Elementor template data without proper authorization. This could lead to unauthorized disclosure of template content, which may include proprietary or sensitive design elements. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for plugin updates from the vendor. Avoid granting unnecessary privileges to users who do not require them.