The vulnerability arises from the Royal Addons for Elementor WordPress plugin failing to enforce visibility checks before returning a post’s content via an unauthenticated AJAX action. An attacker can request the wpr_get_page_content endpoint and obtain the full content of posts stored in non‑public post types, such as contact‑form entries, exposing names, email addresses, and messages. This results in a loss of confidentiality.

Royal Addons for Elementor, a WordPress plugin, versions earlier than 1.7.1070 (including the 1.3.81‑1.7.1069 range). Systems using these plugins are susceptible unless the plugin is updated or the endpoint is otherwise restricted.

The flaw can be exploited without authentication by issuing a simple HTTP request to the wpr_get_page_content AJAX action. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the absence of a visibility check makes the attack straightforward. As the exposed data may contain personally identifiable information, the unintended disclosure could be significant. No complex prerequisites exist beyond the presence of the vulnerable plugin version.