Better Post Widgets CVE-2026-115949

Exploitation requires an authenticated session on the target WordPress site at low privilege (CVSS PR:L) - typically a registered account such as a subscriber, which is most reachable where open user registration is enabled. The flaw is a missing authorization check (CWE-862) in the Better Post & Filter Widgets for Elementor plugin at versions up to and including 1.9.1, exposing sensitive data (C:H) with no integrity or availability impact. The exact plugin feature, endpoint, or access-control setting that is improperly protected is not described in the available sources. Limiting factors: the attacker must hold a valid account (not fully unauthenticated), and impact is confined to information disclosure; the plugin must be installed and active alongside Elementor.

This is a moderate-priority, not emergency, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-exploitable, low-complexity missing-authorization flaw (CWE-862) that requires some level of authentication (PR:L) and yields a confidentiality-only impact (C:H, with no integrity or availability effect). The vuln.today decision label is 'this_month' rather than act_now or emergency, which is consistent with the signal picture: there is no CISA KEV listing (not confirmed as actively exploited), no EPSS score was supplied, and no verified working exploit code is referenced - only a Patchstack database advisory. The signals are internally consistent rather than conflicting: a medium-severity, authenticated data-exposure bug in a WordPress plugin. EPSS is simply absent (not provided), so exploitation probability cannot be quantified from this input. The PR:L requirement meaningfully limits blast radius, since an attacker needs at least a valid low-privilege account on the target site. Treat as a scheduled-patch item, not a drop-everything emergency, pending any change in KEV/EPSS status.

An attacker who already holds a low-privilege authenticated account (e.g., a self-registered subscriber on a site with open registration) sends a request to a plugin endpoint that fails to enforce proper authorization, and receives data they should not be able to read. Because the impact is confidentiality-only (C:H, I:N, A:N), the realistic outcome is disclosure of sensitive information rather than modification or site takeover. No verified public exploit code is referenced; only a Patchstack advisory exists at the time of analysis.