A high-severity vulnerability has been identified in the Leap13 Premium Addons for Elementor plugin for WordPress. This flaw allows an unauthorized attacker to retrieve sensitive system information, which could expose confidential data and be used to facilitate further, more severe attacks against the affected website and underlying infrastructure.

The vulnerability is an Exposure of Sensitive System Information to an Unauthorized Control Sphere. The "Premium Addons for Elementor" plugin fails to properly restrict access to certain internal data or functions. An unauthenticated attacker can craft a specific request to a vulnerable component of the plugin, causing it to disclose sensitive information that should be protected. This information could include system paths, configuration details, or other embedded data that could be leveraged by an attacker to map the internal environment and plan subsequent attacks.

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could lead to a significant data breach, exposing confidential company information, customer data, or technical details about the web server's configuration. The potential consequences include reputational damage, loss of customer trust, regulatory fines (e.g., under GDPR or CCPA), and providing attackers with the necessary intelligence to launch more complex attacks against the organization's infrastructure.

Immediate Action: Immediately apply the security updates provided by the vendor (Leap13) to patch the vulnerability. After patching, it is crucial to monitor for any signs of exploitation attempts that may have occurred prior to the update and to review web server access logs for suspicious activity.

Proactive Monitoring: Security teams should monitor web server and WAF (Web Application Firewall) logs for unusual or direct requests to the plugin's files or API endpoints. Look for patterns indicative of reconnaissance or data retrieval attempts. Monitor network traffic for any unexpected outbound data flows from the web server.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to block malicious requests targeting the known vulnerable components of the Premium Addons for Elementor plugin. Restrict access to the website's administrative panel and ensure file permissions on the web server are hardened to limit potential damage.

Public Exploit Available: false

Given the high CVSS score of 7.5 and the risk of sensitive data exposure, we strongly recommend that organizations using the "Premium Addons for Elementor" plugin prioritize the immediate application of the vendor-supplied patch. Although this CVE is not currently listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, its severity makes it a likely target for future exploitation. Proactive patching and monitoring are critical to mitigating the risk of a data breach.