# PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.1 - Authenticated (Contributor+) Sensitive Information Exposure via Posts, Content Ticker and Marquee Widget Filter Settings

- **ID:** WPSEC-2026-1480
- **Plugin:** PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (`powerpack-lite-for-elementor`), https://wordpress.org/plugins/powerpack-lite-for-elementor/
- **Affected versions:** all versions before 3.1.2
- **Fixed in:** 3.1.2 (Update to 3.1.2 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1480/

## Description

The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Sensitive Information Exposure via the Posts, Content Ticker and Marquee widgets in all versions up to, and including, 3.1.1. This is due to the author and post filter type widget settings being used directly as WP_Query argument keys without restricting them to allowed values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary query variables such as post_status and render the contents of private, draft, pending or scheduled posts they should not be able to view.

## References

- https://wpsec.com/vuln/WPSEC-2026-1480/
- https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.1.2/
- https://wordpress.org/plugins/powerpack-lite-for-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1480/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.