CVE-2024-8801 is a sensitive information exposure vulnerability in the Happy Addons for Elementor plugin for WordPress, affecting all versions up to 3.12.2. Authenticated attackers with Contributor-level privileges or above can exploit the Content Switcher widget to extract private, draft, and pending Elementor templates. This exposure does not affect availability or integrity but compromises confidentiality of sensitive template data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with Contributor-level access or higher can access sensitive Elementor template data that is intended to remain private or unpublished. This may lead to unauthorized disclosure of design and content elements, potentially aiding further attacks or information gathering. There is no impact on system integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to template access. Avoid granting unnecessary privileges to users. Follow updates from thehappymonster for an official patch or temporary mitigation.