The WPZOOM Addons for Elementor plugin contains a missing capability check in the ajax_post_grid_load_more function. An unauthenticated attacker can call this Ajax endpoint and retrieve the titles and excerpts of posts that are marked as draft, future, or pending, exposing content that should remain confidential. This results in moderate information disclosure.

WordPress sites that have the wpzoom:WPZOOM Addons for Elementor – Starter Templates & Widgets plugin installed with a version up to and including 1.3.2 are impacted. The vulnerability is present in all versions of the plugin through 1.3.2.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of real‑world exploitation at this time. The weakness is not currently listed in CISA’s KEV catalog, but the vulnerability can be triggered simply by accessing the public Ajax URL, requiring no prior authentication or complex conditions. If exploited, an attacker gains read access to protected post content, potentially revealing sensitive information or compromising user privacy.