Threats tagged 'ghsa-v689-9j43-xq5j'

The Royal Addons for Elementor WordPress plugin versions before 1.7.1070 improperly handle access control for post content in non-public post types. Specifically, the plugin does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action. This flaw allows unauthenticated users to access sensitive content such as captured contact-form submissions containing personal information.