The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.4.0 due to missing capability checks on the get_megamenu_content() function, a weakness classified as CWE-284 (Improper Authorization) and CWE-862 (Missing Authorization). This flaw permits anyone—without authentication—to retrieve the content of any Elementor item, including posts, pages, templates, drafts, trashed, or private items, thereby exposing confidential or unpublished data.

The affected vendor is roxnor, developer of ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor. All releases up to version 3.4.0 are impacted, regardless of the WordPress installation version. Administrators should verify the installed plugin version; any deployment using 3.4.0 or earlier is vulnerable.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is listed as not included in CISA KEV, further indicating limited known exploitation. Attackers can exploit this via unauthenticated HTTP requests to the get_megamenu_content endpoint, which does not enforce proper authorization checks. An attacker would receive full HTML or JSON structures of Elementor elements, potentially revealing sensitive or unpublished data.