Description

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T07:17:11.037Z",
  "pubdate": "2026-09-04T07:17:11.037Z",
  "executiveSummary": "The Xpro Addons — 140+ Widgets for Elementor WordPress plugin, in versions prior to 1.7.8, contains a critical information disclosure vulnerability. This flaw stems from a lack of authorization checks when rendering WooCommerce product summaries via product identifiers. The vulnerability allows unauthenticated remote attackers to gain unauthorized access to sensitive product data, including prices, SKUs, descriptions, and stock status. Crucially, this exposure extends to products with restricted visibility settings, such as drafts, pending reviews, private, or scheduled items. The risk to the organization involves the potential leakage of proprietary business intelligence, pricing strategies, and inventory management data, which are intended to remain confidential until a formal publication date. Because the flaw requires no authentication and can be triggered via standard web requests, the attack surface is exposed to any visitor with network access to the affected WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of the product summary rendering functionality within the Xpro Addons plugin. The plugin fails to validate user capabilities (e.g., current_user_can) or verify the post_status attribute of the requested WooCommerce product object before retrieving and displaying its details. In WordPress, retrieving a post or product object by ID is a standard operation, but developers are responsible for ensuring that objects with restricted access—such as those not marked as 'publish'—are not accessible to unauthorized users.\nThe exploitation flow begins when an unauthenticated actor sends a request to the server that triggers the vulnerable widget rendering logic. By supplying a valid product identifier (post ID) as a parameter, the attacker forces the plugin to invoke a rendering function that fetches the WooCommerce product data from the database. Because the plugin does not cross-reference the product's current status against the requester's permissions, the backend process returns the product object regardless of its privacy state.\nSpecifically, the plugin processes the product identifier and executes a query to retrieve the associated WooCommerce metadata, such as the title, price, SKU, detailed description, and real-time stock levels. Since the plugin's code path lacks an authentication gating mechanism or an authorization check against the WordPress access control list (ACL), the response is serialized and returned to the attacker's client. This allows for the programmatic enumeration of products that the store administrator has hidden from the public view.\nThe post-exploitation impact is significant for e-commerce integrity. Attackers can perform reconnaissance on upcoming inventory, discover planned pricing changes before they are effective, and scrape private product metadata that may reveal internal project codenames or confidential supplier information. The vulnerability is entirely network-accessible and requires no prior knowledge of the system's internal state beyond a valid product ID, which can often be guessed or identified through common enumeration techniques. The issue affects all installations running versions prior to 1.7.8, making immediate remediation essential to ensure data confidentiality."
}