An unauthenticated sensitive data exposure flaw allows anyone to read protected information from a WordPress site that hosts the Exclusive Addons Elementor plugin built by Tim Strifler. The vulnerability is caused by the plugin's failure to enforce proper authentication before retrieving data, leading to a loss of data confidentiality. The documented weakness corresponds to CWE‑497, which highlights improper handling of authenticated requests.

Any WordPress installation using the Exclusive Addons Elementor plugin version 2.8.0 or earlier is affected. Installing or updating to a version equal to or greater than 2.8.1 removes the flaw. Sites that cannot upgrade should remove or disable the plugin to eliminate exposure.

The CVSS score of 5.3 classifies this as a moderate-severity issue. An EPSS score of less than 1% indicates that exploitation is unlikely at present, and the plugin is not listed in the CISA KEV catalog. Nevertheless, because the flaw is unauthenticated, any visitor can potentially trigger the vulnerability by sending a request to the plugin’s public endpoint, allowing an attacker to compromise the confidentiality of the site’s data.