Vulnerabilities / PowerPack Addons for Elementor: Widgets, Form Styler and Templates / WPSEC-2026-3012
PowerPack Addons for Elementor: Widgets, Form Styler and Templates <= 3.1.4 - Unauthenticated Sensitive Information Exposure via Display Conditions
Medium 5.3
CWE-200Fixed in 3.2.0
- ID
- WPSEC-2026-3012
- Plugin
- PowerPack Addons for Elementor: Widgets, Form Styler and Templates (powerpack-lite-for-elementor)
- Affected
- all versions before 3.2.0
- Remediation
- Update to 3.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- PowerPack Addons for Elementor: Widgets, Form Styler and Templates on WPSec AttackSurface
- Fix released
- Published
Description
The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Display Conditions extension in all versions up to, and including, 3.1.4, due to the plugin not keeping elements hidden by display conditions out of the plain-text copy of the page that Elementor saves to post_content. This makes it possible for unauthenticated attackers to read content that was meant to be shown only to some visitors, such as logged-in users or certain roles, through the post excerpt in the REST API, feeds and site search.
References
- https://wpsec.com/vuln/WPSEC-2026-3012/
- https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.2.0/
- https://wordpress.org/plugins/powerpack-lite-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS