The Piotnet Addons For Elementor plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in the 'pafe_posts_list' function. This flaw allows unauthenticated remote attackers to retrieve sensitive data including titles and excerpts of unpublished blog posts (future, draft, pending) in all versions up to and including 2.4.29. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting its network attack vector, low complexity, no privileges required, and impact limited to confidentiality.

An attacker without authentication can extract sensitive unpublished content from affected WordPress sites using the vulnerable plugin. This could lead to unintended disclosure of confidential or pre-release information. There is no impact on data integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix links are provided, administrators should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable functionality or plugin to prevent unauthorized data exposure.