EUVD-2026-108034
GHSA-v37q-52wg-3989
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitInvoke plugin endpoint missing authorization check
-
ExecutionBypass access-control boundary
-
ImpactRead unauthorized data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on the target site (PR:L) - typically a low-privilege role such as subscriber - and the site must be running PowerPack Addons for Elementor (powerpack-lite-for-elementor) at any version up to and including 3.1.0. The flaw is a missing authorization/capability check on a plugin action, so no special non-default configuration or user interaction is needed, but exploitation is limited by the authentication requirement and yields only limited confidentiality disclosure (no integrity or availability impact). Anonymous/unauthenticated exploitation is not supported by the CVSS vector. |
| Impact | This is a medium-severity (CVSS 4.3) Missing Authorization flaw (CWE-862) whose real-world urgency is low. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates network-reachable, low-complexity exploitation but requires an already-authenticated low-privileged account (PR:L), and the only impact is a limited confidentiality breach (C:L) with no integrity or availability effect. No EPSS probability, CISA KEV entry, or public proof-of-concept was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. The signals are internally consistent - a modest authorization-boundary bug typical of Patchstack-reported WordPress plugin issues - rather than conflicting. Bottom line: a genuine but low-priority defect, not a drop-everything issue; it warrants routine patching rather than emergency response. Note that EPSS data is absent, so exploitation probability cannot be quantified. |
| Exploit ScenarioDerived | An attacker who holds any low-privileged account (e.g., subscriber) on a WordPress site running PowerPack Addons for Elementor ≤ 3.1.0 sends a request to a plugin action that lacks a proper capability/authorization check, obtaining data or functionality intended for higher-privileged roles. No public exploit code is identified, and exploitation is bounded to a limited confidentiality disclosure per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
PowerPack Addons for Elementor through 3.1.0 lets authenticated low-privilege users bypass access controls and read limited protected data because a plugin action lacks a capability check. The medium-severity CVSS 4.3 flaw requires a valid account (PR:L) and yields only confidentiality impact; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
RemediationAI
No exact fixed version is identified in the provided data; check the Patchstack advisory for the current patched release and upgrade PowerPack Addons for Elementor beyond 3.1.0 as soon as a fix is published. Until then, reduce exposure by limiting self-registration and auditing low-privilege accounts, since exploitation requires an authenticated subscriber-level session; disabling the plugin removes the vulnerable action but also removes its Elementor widgets and features. Consider a WAF or virtual patching rule that blocks suspicious requests to the plugin's AJAX/REST endpoints from low-privilege users, and monitor logs for unusual data reads by subscriber accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a WordPress plugin missing authorization (CWE-862): an action exposed by PowerPack Addons for Elementor fails to call current_user_can() or an equivalent capability check before returning data. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates the endpoint is reachable over the network but requires any authenticated account-such as a subscriber-and exposes only limited confidential information without modifying or disrupting the site. The Patchstack advisory tracks this as broken access control / authentication bypass in powerpack-lite-for-elementor up to 3.1.0.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable action with no user interaction (AV:N/AC:L/UI:N) but requires an authenticated low-privilege WordPress account (PR:L), yielding only limited data disclosure (C:L, I:N, A:N).
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB