The ElementsKit Elementor Addons plugin for WordPress contains an information exposure vulnerability (CWE-200) in versions up to 3.2.0. The root cause is the lack of proper capability checks in the ekit_widgetarea_content function, which leads to unauthorized access to Elementor-created content such as posts, pages, templates, including drafts, pending, and private items. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no indication of known exploits in the wild or an official patch available at this time.

An unauthenticated attacker can view sensitive content managed by the Elementor plugin, including unpublished or private items. This exposure could lead to leakage of confidential or sensitive information stored within WordPress sites using this plugin. There is no indication of integrity or availability impact, only confidentiality is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting access to the plugin or disabling it if possible to prevent unauthorized content exposure. Monitor vendor channels for updates and apply patches promptly once available.