This vulnerability (CVE-2026-65505) affects Ultimate Store Kit Elementor Addons by bdthemes, allowing unauthenticated users to access sensitive system information. The issue is categorized as CWE-497, which involves exposure of sensitive data to unauthorized entities. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts versions up to and including 3.0.5. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An unauthenticated attacker can gain access to sensitive system information, which could potentially aid in further attacks or reconnaissance. The confidentiality impact is low, with no integrity or availability impacts reported. This exposure could reveal configuration details or other sensitive data that should not be publicly accessible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for updates from bdthemes. Avoid exposing the plugin to untrusted networks if possible.