The Envo's Templates & Widgets for Elementor and WooCommerce plugin suffers from a missing authorization check (CWE-862) in the render() method of the Envo Tabs widget. This method passes a user-controlled template or post ID directly to Elementor's get_builder_content_for_display() function without verifying the post's publication status or the visitor's authorization. Consequently, authenticated users with Author-level privileges or higher can configure the widget on a public post to reference private or draft Elementor content, thereby exposing this content to unauthenticated visitors. The vulnerability affects versions up to and including 1.4.26. No official patch or remediation has been confirmed at this time.

An attacker with Author-level access or higher can disclose the contents of private or draft Elementor-driven pages and templates to anonymous users. This results in unauthorized information disclosure but does not impact integrity or availability. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and monitor for suspicious widget configurations referencing private content IDs. Avoid using the Envo Tabs widget to reference sensitive or private Elementor templates in publicly accessible posts.