CVE-2023-6582 json
ElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information Exposure
published 2024-01-11 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58806
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3 via the ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to obtain contents of posts in draft, private or pending review status that should not be visible to the general public. This applies to posts created with Elementor only.
Patch / fix
- wpmet elements_kit_elementor_addons 3.0.4
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected products
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
Classification
- Weakness
-
- CWE-284 Improper Access Control
- Technology feeds
References
-
plugins.trac.wordpress.org
/browser/elementskit-lite/tags/3.0.3/modules/controls/widget-area-utils.php#L15
patch
-
plugins.trac.wordpress.org
/browser/elementskit-lite/tags/3.0.3/widgets/init/enqueue-scripts.php#L44
patch
-
plugins.trac.wordpress.org
/changeset/3011323/elementskit-lite/trunk/modules/controls/widget-area-utils.php
patch
-
wordfence.com
/threat-intel/vulnerabilities/id/ff4ae5c8-d164-4c2f-9bf3-83934c22cf4c?source=cve
third-party-advisory
Sources
- CVE List CVE-2023-6582
- NVD CVE-2023-6582
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.