The Xpro Elementor Addons – Pro plugin for WordPress includes an insecure Draw SVG widget that allows authenticated users with Contributor or higher privileges to read arbitrary files from the server. This flaw, identified as CWE‑73, permits disclosure of confidential data such as configuration files, database credentials, or code, potentially enabling further attacks.

All WPXpro Xpro Elementor Addons – Pro installations running version 1.4.7 or earlier are affected; no further sub‑version details are provided, so any build of the plugin up to and including 1.4.7 remains vulnerable.

The CVSS score of 6.5 indicates moderate severity, with no EPSS data available to gauge exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with Contributor or higher permissions, inferred from the description; an attacker would need legitimate login credentials or elevated privileges on the WordPress site to read files.