The Elementor Website Builder Pro plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) identified as CVE-2024-8494. This vulnerability allows authenticated users with Contributor or higher privileges to access the content of Private, Pending, and Draft Templates through the 'elementor-template' shortcode. Although a partial fix was implemented in version 3.24.4, versions up to 3.25.10 remain vulnerable. The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The vulnerability does not impact integrity or availability, only confidentiality.

An attacker with Contributor-level or higher access can read sensitive template content that should be restricted, potentially exposing unpublished or private design data. This exposure could lead to information leakage within the affected WordPress environment. There is no indication of impact on system integrity or availability. No known exploits have been reported in the wild.

A partial patch addressing this vulnerability was released in version 3.24.4 of Elementor Website Builder Pro. However, versions up to 3.25.10 remain vulnerable. Since no official patch or remediation link is provided for versions beyond 3.24.4, users should verify with the vendor for updated patches or guidance. Until a full fix is confirmed, restrict Contributor-level access to trusted users only and monitor for updates from Elementor. Patch status is not yet confirmed for versions after 3.24.4 — check the vendor advisory for current remediation guidance.