CyberRota Analysis
AI-GeneratedThe Elementor Website Builder plugin for WordPress versions prior to 4.1.4 is vulnerable due to inadequate user permission checks in its REST endpoints, enabling authenticated users with Contributor-level access or higher to access private posts, pages, and drafts authored by others, including administrators. This could lead to unauthorized disclosure of sensitive content within the site. WordPress site administrators and security teams should prioritize this vulnerability to mitigate potential data leaks.
Original NVD Description
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).