{
 "id": "WPSEC-2026-3012",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3012/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3012/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3012/index.md",
 "title": "PowerPack Addons for Elementor: Widgets, Form Styler and Templates <= 3.1.4 - Unauthenticated Sensitive Information Exposure via Display Conditions",
 "description": "The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Display Conditions extension in all versions up to, and including, 3.1.4, due to the plugin not keeping elements hidden by display conditions out of the plain-text copy of the page that Elementor saves to post_content. This makes it possible for unauthenticated attackers to read content that was meant to be shown only to some visitors, such as logged-in users or certain roles, through the post excerpt in the REST API, feeds and site search.",
 "plugin": {
  "slug": "powerpack-lite-for-elementor",
  "name": "PowerPack Addons for Elementor: Widgets, Form Styler and Templates",
  "full_name": "PowerPack Addons for Elementor: Widgets, Form Styler and Templates",
  "wordpress_org": "https://wordpress.org/plugins/powerpack-lite-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/powerpack-lite-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.2.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.2.0",
 "remediation": "Update to 3.2.0 or later.",
 "fix_released": "2026-11-12T01:45:14+00:00",
 "published": "2026-11-13T02:51:31+00:00",
 "updated": "2026-11-12T17:07:49.737693+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3012/",
  "https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.2.0/",
  "https://wordpress.org/plugins/powerpack-lite-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}