Information Disclosure in Elementor Website Builder REST Post Query

The Elementor REST post-query endpoint built its WP_Query arguments with post_status 'any' for authenticated requests without restricting results to the requesting user, so any logged-in user (Contributor and above) could enumerate and read the titles and IDs of other authors' private and draft posts. The fix restricts the query to the current...