Based on the description, it is inferred that the attack vector is a direct HTTP request to the AJAX endpoint provided by the plugin. The vulnerability exists in the pagination endpoint of the Essential Addons for Elementor plugin for WordPress versions earlier than 6.8.7. The endpoint accepts a post type and meta query from an unauthenticated user and does not enforce any access restrictions, enabling the user to request the content of non‑public post types and the values of private custom fields on published posts. This can lead to the exposure of sensitive information that should remain confidential, without affecting the integrity or availability of the site.

Any WordPress installation that has the Essential Addons for Elementor plugin version below 6.8.7 deployed. The plugin is part of the Essential Addons package, and its documentation indicates that all sites using it are subject to the issue until an update is applied.

Based on the description, it is inferred that exploitation requires no authentication and is trivial for an attacker. There is no publicly listed exploit or KEV listing for this vulnerability and the EPSS score is not available, indicating a low to moderate likelihood of current exploitation. However, the lack of authorization controls means that any user—including anonymous visitors—can gain access to restricted content. The risk profile is primarily driven by the information disclosure potential, and the simplest attack vector is a direct HTTP request to the pagination AJAX endpoint configured by the plugin. A successful exploit requires no authentication, making it trivial for an attacker to harvest sensitive data.