Sensible system information is exposed through the WPDeveloper Essential Addons for Elementor Lite plugin. The flaw allows an unauthenticated or minimally privileged user to retrieve embedded sensitive data that the plugin should protect, violating confidentiality principles. The weakness is classified as CWE‑497, indicating a failure to properly secure or remove sensitive data from memory or output streams.

All installations of the WPDeveloper Essential Addons for Elementor Lite plugin, version 6.1.9 or earlier, are vulnerable. The issue applies to the Lite edition as identified by the CPE and vendor listing.

The CVSS score of 4.3 indicates a moderate threat level, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Because the vulnerability is not listed in the CISA KEV catalog, it has not yet been observed in widespread targeted attacks. However, the likely attack vector is local or low‑privilege where an attacker can access the WordPress site or its configuration files; the description does not specify a remote code execution path, so a remote exploit is inferred to be unlikely based on the provided information.