Premium Addons CVE-2026-109890

The target must run Premium Addons for Elementor (a WordPress plugin, which itself requires the Elementor page builder) at version 4.11.110 or earlier. The CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction are required, so exploitation works against default installations without credentials. The practical limiter is impact scope, not access: the flaw yields only LOW confidentiality impact (C:L, I:N, A:N), meaning an attacker gains unauthorized read access to limited data or a restricted action rather than site control. The input description does not name the exact vulnerable endpoint, parameter, or configuration setting, so the precise feature that lacks the authorization check cannot be confirmed from available data.

This is a moderate-severity, low-priority issue despite being network-exploitable without authentication. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) indicates a remotely reachable, low-complexity flaw requiring no privileges or user interaction, but the impact is confined to a LOW confidentiality breach with NO integrity or availability impact - consistent with a missing-authorization (CWE-862) flaw that exposes limited data or functionality rather than enabling takeover. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no signal of active or probable exploitation; the only source is a single Patchstack advisory. The combination of easy reachability but minimal impact means this is a genuine-but-low-urgency hygiene fix rather than an emergency. Note a mild tension: the input Tag labels this 'Authentication Bypass,' whereas the description and CWE-862 describe broken access control / missing authorization - these are related but distinct, and the C:L/I:N/A:N impact argues against a full authentication bypass granting broad control.

A remote, unauthenticated attacker sends a crafted request to an endpoint or AJAX action exposed by the Premium Addons for Elementor plugin that fails to enforce a capability/authorization check, causing it to return or act on data the requester should not be able to access. Because no privileges or user interaction are required and complexity is low, the request can be issued directly against any affected site, though the payoff is limited to low-impact confidentiality disclosure. No public exploit identified at time of analysis.