The Premium Addons for Elementor plugin for WordPress suffers from a missing capability check (CWE-862) in the 'get_template_content' function. This flaw allows unauthenticated remote attackers to retrieve the content of private, draft, and pending templates without proper authorization. The vulnerability affects all versions up to 4.11.53. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No patch or official fix information is currently available.

An attacker can access sensitive template content that should be restricted, potentially exposing unpublished or private design data. There is no impact on data integrity or availability. The confidentiality breach could aid attackers in reconnaissance or intellectual property theft but does not directly enable further system compromise based on current information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin and monitor for unauthorized access attempts. Avoid exposing the affected plugin on publicly accessible sites if possible.