CVE-2026-2295 is an information exposure vulnerability in the WPZOOM Addons for Elementor – Starter Templates & Widgets WordPress plugin. The flaw arises from the absence of a capability check on the 'ajax_post_grid_load_more' AJAX function, allowing unauthenticated users to retrieve titles and excerpts of posts that are in draft, future, or pending status. This unauthorized data disclosure affects all plugin versions up to and including 1.3.2. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information).

An attacker without authentication can access protected content metadata (titles and excerpts) of unpublished posts, potentially revealing sensitive or confidential information not intended for public view. There is no impact on integrity or availability reported. The exposure is limited to content metadata, not full post content or other sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin's AJAX endpoints via additional access controls or disabling the plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.