The Sky Addons – Elementor Addons with Widgets & Templates plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in all versions up to 2.6.1. Authenticated attackers with Contributor or higher privileges can exploit the render function in modules/content-switcher/widgets/content-switcher.php to extract private, pending, and draft Elementor template data. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges. No known exploits are reported in the wild. No patch or remediation guidance is currently available from the vendor.

An attacker with Contributor-level or higher access can retrieve sensitive Elementor template data that should remain private, including unpublished drafts and pending templates. This exposure could lead to unauthorized disclosure of site design or content information. The vulnerability does not affect integrity or availability, only confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit Contributor-level access to trusted users only and monitor for suspicious activity related to Elementor template data access.