EUVD-2026-41244
GHSA-cc6h-g44v-7c7v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L required because Author-level WordPress account is a prerequisite; C:L reflects disclosure limited to private Elementor post contents only.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) widget's template rendering in versions up to, and including, 1.4.26. The render() method of the Tabs widget passes a user-controlled template/post ID directly to Elementor's get_builder_content_for_display() without verifying the referenced post's status (published/private/draft) or the visitor's authorization to view it. This makes it possible for authenticated attackers, with Author-level access and above, to disclose the contents of private Elementor-driven pages and templates to anonymous visitors by configuring an Envo Tabs widget on a public post to reference the private content's ID (which can be supplied by editing the underlying Elementor widget JSON via the Elementor editor REST API).
AnalysisAI
Private content disclosure in the Envo's Templates & Widgets for Elementor and WooCommerce WordPress plugin (versions up to and including 1.4.26) allows authenticated attackers with Author-level access to expose private or draft Elementor-rendered pages and templates to anonymous visitors. The flaw is rooted in the Tabs and Off Canvas widgets passing a user-supplied post ID directly to Elementor's get_builder_content_for_display() without any post-status or capability check, meaning the rendered output of restricted content is served publicly once an Author configures the widget. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, making this a lower-urgency but real information-disclosure risk for WordPress sites with multiple or untrusted Author-level users.
Technical ContextAI
The vulnerability exists within the WordPress plugin 'envo-elementor-for-woocommerce' in two widget implementations built on top of the Elementor page builder framework: the Tabs widget (modules/tabs/widgets/tabs.php, lines 103 and 1268) and the Off Canvas widget (modules/off-canvas/widgets/off-canvas.php, line 631). Each widget's render() method accepts a template or post ID from widget configuration - a value that an Author-level user can supply via the Elementor editor or its underlying REST API - and passes it directly to Elementor's get_builder_content_for_display(). This Elementor function renders the full content of any post by ID without performing a WordPress capability check (current_user_can()) or validating post_status (e.g., publish vs. private vs. draft). CWE-862 (Missing Authorization) describes this root cause precisely: a code path that performs a sensitive action - fetching and rendering restricted content - without enforcing access controls at the rendering boundary. Source code in both 1.4.25 and 1.4.26 tags of the SVN repository is confirmed vulnerable per the referenced plugin browser links.
RemediationAI
Update the Envo's Templates & Widgets for Elementor and WooCommerce plugin to the version released at or after SVN changeset 3578489; consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/26100f1f-3224-486c-b4f9-7086d405a883 for the confirmed patched version number, as it was not independently verifiable from the available data. WordPress auto-updates, if enabled, will deliver the fix automatically. As a compensating control prior to patching, audit and restrict Author-level (and above) access to only fully trusted users - this eliminates the prerequisite account that enables exploitation, though it may disrupt content workflows. A more aggressive workaround is to disable the Envo Tabs and Off Canvas widgets within the Elementor widget manager, which removes the vulnerable rendering path entirely at the cost of losing those widget features site-wide. Monitoring Elementor editor access logs for unusual post-ID references in widget configurations can serve as a detection control.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today