The ElementsKit Elementor Addons plugin for WordPress suffers from improper access control (CWE-284) due to missing capability checks on the get_megamenu_content() function. This flaw enables unauthenticated users to retrieve sensitive content managed by Elementor, including private and draft items. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a medium severity level with network attack vector, no privileges required, and no user interaction needed. No official patch or remediation guidance is currently provided by the vendor or advisory sources.

An attacker without authentication can view sensitive information stored in Elementor items such as posts, pages, templates, drafts, trashed, and private content. This exposure compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin or disable it if possible to prevent unauthorized information disclosure.