{
 "id": "WPSEC-2026-1480",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1480/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1480/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1480/index.md",
 "title": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.1 - Authenticated (Contributor+) Sensitive Information Exposure via Posts, Content Ticker and Marquee Widget Filter Settings",
 "description": "The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Sensitive Information Exposure via the Posts, Content Ticker and Marquee widgets in all versions up to, and including, 3.1.1. This is due to the author and post filter type widget settings being used directly as WP_Query argument keys without restricting them to allowed values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary query variables such as post_status and render the contents of private, draft, pending or scheduled posts they should not be able to view.",
 "plugin": {
  "slug": "powerpack-lite-for-elementor",
  "name": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)",
  "full_name": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)",
  "wordpress_org": "https://wordpress.org/plugins/powerpack-lite-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/powerpack-lite-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.2",
 "remediation": "Update to 3.1.2 or later.",
 "fix_released": "2026-10-22T01:37:58+00:00",
 "published": "2026-10-23T01:41:18+00:00",
 "updated": "2026-10-22T09:32:58.460723+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1480/",
  "https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.1.2/",
  "https://wordpress.org/plugins/powerpack-lite-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-22"
 }
}