The Xpro Elementor Addons - Pro plugin for WordPress contains an arbitrary file read vulnerability (CWE-73) in the Draw SVG widget. Authenticated attackers with Contributor-level privileges or above can exploit this flaw to read arbitrary files on the server, potentially exposing sensitive data. This affects all plugin versions up to and including 1.4.7. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity), with network attack vector, low attack complexity, and no user interaction required. No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated user with Contributor or higher privileges to read arbitrary files on the server hosting the WordPress site. This can lead to disclosure of sensitive information such as configuration files, credentials, or other data stored on the server. There is no indication of integrity or availability impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, restrict Contributor-level access and above to trusted users only. Monitor for updates from WPXpro regarding a security update addressing this vulnerability.