The DethemeKit For Elementor plugin for WordPress suffers from a vulnerability that allows authenticated users with Contributor-level access or higher to duplicate posts that are password protected, private, draft, or scheduled. By using the duplicate_post() function, the attacker can retrieve the content of posts that the user should not be able to view, thereby exposing sensitive information. This flaw is a classic example of an information exposure weakness (CWE‑639).

All installations of DethemeKit for Elementor version 2.36 or earlier are affected. The plugin is distributed by Detheme and installed via the WordPress plugin repository. Any site running one of these affected versions may be vulnerable if it grants contributors the ability to duplicate posts.

The CVSS score of 4.3 indicates moderate severity. An EPSS score of less than 1% suggests a low probability of exploitation in the wild, but the flaw remains public and the function can be invoked by any user with the Contributor capability. Because the attack requires authenticated access, it is not a remote code execution vector, yet it exposes confidential content. The vulnerability is not listed in the CISA KEV catalog, and no official Certified CNA workaround is available. Attacker likely obtains the exposed data by simply duplicating the restricted post through the plugin’s UI or API.