The Sina Extension for Elementor plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in the render function located in widgets/advanced/sina-modal-box.php. This flaw allows authenticated users with Contributor-level privileges or above to extract sensitive Elementor template data including private, pending, and draft content. The issue affects all versions up to and including 3.5.7. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and limited confidentiality impact. No patch or remediation guidance is currently provided by the vendor.

An attacker with Contributor-level access or higher can access sensitive Elementor template data that should be restricted, potentially leading to unauthorized disclosure of private or unpublished content. The vulnerability does not affect system integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to Elementor templates. Avoid granting unnecessary privileges to users who do not require them.