Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup

Vulnerability

The Elementor Addon Elements plugin for WordPress versions up to and including 1.13.10 contains a sensitive information exposure vulnerability in the render function of the modal popup widget located in modules/modal-popup/widgets/modal-popup.php. This allows authenticated attackers with at least Contributor-level access to extract private, pending, scheduled, and draft template data that should be restricted.

Exploitation

An attacker with a Contributor-level account or higher can exploit this by crafting a request that triggers the vulnerable render function without proper authorization checks. No user interaction is required beyond the attacker's own authentication.

Impact

Successful exploitation results in unauthorized disclosure of sensitive template data, including private, pending, scheduled, and draft templates. This could leak unpublished content or drafts, leading to information disclosure and potential business or privacy impacts.

Mitigation

The vulnerability has been fixed in version 1.14.5 of the plugin, as indicated on the WordPress plugin repository [1]. Users are strongly advised to update to the latest version immediately. No workarounds are mentioned in the available references.