The Jeg Kit for Elementor plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in the render_content function within class/elements/views/class-tabs-view.php. Authenticated attackers with Contributor-level privileges or higher can exploit this flaw to extract private, pending, and draft template data. The vulnerability affects all versions up to and including 2.6.9. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges. There is no indication of known exploits in the wild or an official patch at this time.

An attacker with Contributor-level or higher access can view sensitive template data that should be restricted, potentially leading to unauthorized disclosure of private content. There is no impact on integrity or availability reported. The exposure is limited to users who already have some level of authenticated access, not public unauthenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit Contributor-level access to trusted users only. Monitor official jegtheme advisories for updates regarding patches or workarounds.