# PowerPack Addons for Elementor: Widgets, Form Styler and Templates <= 3.1.4 - Unauthenticated Sensitive Information Exposure via Display Conditions

- **ID:** WPSEC-2026-3012
- **Plugin:** PowerPack Addons for Elementor: Widgets, Form Styler and Templates (`powerpack-lite-for-elementor`), https://wordpress.org/plugins/powerpack-lite-for-elementor/
- **Affected versions:** all versions before 3.2.0
- **Fixed in:** 3.2.0 (Update to 3.2.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3012/

## Description

The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Display Conditions extension in all versions up to, and including, 3.1.4, due to the plugin not keeping elements hidden by display conditions out of the plain-text copy of the page that Elementor saves to post_content. This makes it possible for unauthenticated attackers to read content that was meant to be shown only to some visitors, such as logged-in users or certain roles, through the post excerpt in the REST API, feeds and site search.

## References

- https://wpsec.com/vuln/WPSEC-2026-3012/
- https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.2.0/
- https://wordpress.org/plugins/powerpack-lite-for-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3012/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.