The vulnerability arises in Elementor Website Builder plugin versions up to 4.1.3, allowing users to access sensitive data that should be protected. This flaw is classified as CWE-862, indicating an authorization weakness where information that ought to be restricted is exposed. If exploited, attackers could read personal or confidential data stored or managed by the plugin, compromising confidentiality and potentially violating regulatory requirements.

The affected systems are WordPress sites that include the Elementor Website Builder plugin with a version equal to or below 4.1.3. The plugin is distributed under the vendor Elementor, and any WordPress installation using these legacy versions is susceptible until the plugin is updated.

The CVSS score of 6.5 places this vulnerability in the medium severity range, indicating a non-negligible risk. The EPSS score is not available, so the current likelihood of exploitation is unclear; however, because the vulnerability involves sensitive data exposure and the plugin is widely used, there could be a moderate exploitation probability. The system is not listed in the CISA KEV catalog. The attack vector is not specified in the CVE data; therefore, the exact conditions required for exploitation remain unspecified.