The Responsive Addons for Elementor plugin for WordPress contains a sensitive information exposure vulnerability in the 'register_user' function affecting all versions up to 1.6.8. Authenticated attackers with Contributor or higher privileges can extract usernames and passwords of users registering through the Edit Login | Registration Form widget, contingent on the user opening the registration success email. The CVSS 3.1 score is 5.7 (medium severity), reflecting network attack vector, low attack complexity, required privileges, and user interaction. No known exploits are reported in the wild. No patch or remediation details are provided by the vendor or advisory.

An attacker with Contributor-level or higher access can obtain sensitive credentials of users registering via the affected widget, potentially compromising user accounts. The vulnerability does not affect confidentiality beyond the exposed data and does not impact integrity or availability. Exploitation requires user interaction (opening an email notification). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to user registration notifications. Avoid relying on the affected widget for user registration or disable it if possible.