Elementor Website Builder vulnerabilities

The Elementor Website Builder plugin version 4.1.3 and earlier contains a contributor sensitive data exposure vulnerability. This flaw may allow an attacker to access confidential information stored by the plugin.

The Elementor Website Builder plugin is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects versions from n/a through 4.3.1.

The Elementor Website Builder WordPress plugin before version 4.1.4 fails to properly check user permissions before returning post data via one of its REST endpoints. This allows authenticated users with Contributor-level access and above to retrieve the title, body, and metadata of private posts, private pages, and drafts authored by other users (including administrators).

Missing authorization in the Elementor Website Builder plugin for WordPress (versions up to 4.1.0) allows exploiting incorrectly configured access control security levels.

The Elementor Website Builder plugin for WordPress in versions up to and including 3.33.0 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.