The Qi Addons For Elementor plugin for WordPress contains a Sensitive Information Exposure vulnerability (CWE-200) in all versions up to 1.8.0. Authenticated attackers with Contributor-level privileges or above can exploit this issue to access private templates, which are intended to be restricted. The vulnerability arises from improper access control on private template data, allowing unauthorized reading of sensitive content. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring privileges but no user interaction, impacting confidentiality only.

An attacker with Contributor-level access or higher can read private template contents that should be restricted, potentially exposing sensitive design or content data. There is no reported impact on data integrity or system availability. The vulnerability does not allow exploitation by unauthenticated users, limiting the scope to users with some level of access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for any updates from qodeinteractive regarding patches or updates addressing this issue.