The Essential Addons for Elementor plugin for WordPress contains an information exposure vulnerability (CWE-639) in the ajax_load_more function. This flaw arises from inadequate authorization checks on which posts can be included in responses, enabling unauthenticated users to retrieve content from restricted posts such as password protected, private, or draft posts. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No vendor advisory or patch information is currently available, and the plugin is not a cloud service.

An attacker can extract sensitive content from posts that should be inaccessible, including password protected, private, or draft posts. This leads to unauthorized information disclosure but does not affect integrity or availability. The exposure could compromise confidentiality of sensitive or unpublished content on affected WordPress sites using this plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the ajax_load_more functionality or the affected plugin. Monitor for updates from the vendor (wpdevteam) and apply patches promptly once available.