The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress contains a missing authorization check in the Envo Tabs and Off‑Canvas widgets. The widget’s render() method passes a user‑supplied template or page ID directly to Elementor’s get_builder_content_for_display() without verifying whether the referenced post is published, private, or draft, or whether the viewer is entitled to view it. This flaw, classified as CWE‑862, allows an authenticated Author‑level user or any higher‑privileged user to embed the ID of a private or draft Elementor page in a public post. When that post is accessed by anonymous visitors, the private content is effectively leaking confidential Elementor‑driven pages to unauthenticated users.

WordPress installations that have the Envo's Templates & Widgets for Elementor and WooCommerce plugin installed, using any version up to and including 1.4.26. Sites with accounts that grant Author or higher access and that enable editing of widget JSON via the Elementor REST API are vulnerable, because those users can supply the private content ID to the affected widget.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability that this vulnerability will be widely exploited in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate user with Author‑level (or can modify widget JSON, after which the compromised widget causes persistent disclosure of private Elementor content to anyone who visits the public post.