CVE-2026-84146: CWE-200 Information Exposure in Xpro Addons — 140+ Widgets for Elementor

The vulnerability in Xpro Addons — 140+ Widgets for Elementor (CVE-2026-84146) is an information exposure issue classified under CWE-200. It affects versions prior to 1.7.8 of the plugin. The flaw allows unauthenticated visitors to retrieve sensitive WooCommerce product information that should not be publicly accessible because the plugin does not verify user capabilities or product post status before displaying product summaries. This can lead to unauthorized disclosure of product metadata including title, price, SKU, description, and stock details for products that are in non-public states such as draft, pending, private, or scheduled.

The impact is limited to information disclosure of WooCommerce product details that are intended to be non-public. There is no indication of modification, deletion, or denial of service. The disclosed information could potentially aid an attacker in reconnaissance or business intelligence gathering but does not directly compromise system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is indicated, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the plugin or disabling the affected widget may reduce exposure.