What is the CVSS score of CVE-2026-11600?

CVE-2026-11600 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Envo Elementor for WooCommerce CVE-2026-11600

EUVD-2026-41244 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 security@wordfence.com

GHSA-cc6h-g44v-7c7v

Authentication Bypass WordPress

4.3

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

PR:L required because Author-level WordPress account is a prerequisite; C:L reflects disclosure limited to private Elementor post contents only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 06:33 vuln.today

CVE Published

Jul 02, 2026 - 06:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) widget's template rendering in versions up to, and including, 1.4.26. The render() method of the Tabs widget passes a user-controlled template/post ID directly to Elementor's get_builder_content_for_display() without verifying the referenced post's status (published/private/draft) or the visitor's authorization to view it. This makes it possible for authenticated attackers, with Author-level access and above, to disclose the contents of private Elementor-driven pages and templates to anonymous visitors by configuring an Envo Tabs widget on a public post to reference the private content's ID (which can be supplied by editing the underlying Elementor widget JSON via the Elementor editor REST API).

AnalysisAI

Private content disclosure in the Envo's Templates & Widgets for Elementor and WooCommerce WordPress plugin (versions up to and including 1.4.26) allows authenticated attackers with Author-level access to expose private or draft Elementor-rendered pages and templates to anonymous visitors. The flaw is rooted in the Tabs and Off Canvas widgets passing a user-supplied post ID directly to Elementor's get_builder_content_for_display() without any post-status or capability check, meaning the rendered output of restricted content is served publicly once an Author configures the widget. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain or compromise WordPress Author-level account

Delivery

Open Elementor editor on a public post

Exploit

Configure Envo Tabs widget with target private post ID

Install

Save widget configuration via Elementor REST API

Anonymous visitor loads the public post

Execute

Plugin render() passes private post ID to get_builder_content_for_display()

Impact

Private content disclosed to unauthenticated visitor

Recon

Obtain or compromise WordPress Author-level account

Delivery

Open Elementor editor on a public post

Exploit

Configure Envo Tabs widget with target private post ID

Install

Save widget configuration via Elementor REST API

Anonymous visitor loads the public post

Execute

Plugin render() passes private post ID to get_builder_content_for_display()

Impact

Private content disclosed to unauthenticated visitor

Vulnerability AssessmentAI

Exploitation	Exploitation requires an attacker to hold at minimum a WordPress Author-level role on the target site, which is a prerequisite for accessing the Elementor editor and configuring widget parameters. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (score 4.3) accurately reflects the real-world risk profile: network-exploitable, low complexity, but gated behind an authenticated Author-level account with no scope change and confidentiality-only impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a legitimate WordPress Author account opens the Elementor editor on any publicly accessible post, inserts an Envo Tabs widget, and sets its template ID parameter to the numeric ID of a known or enumerated private page - such as an unreleased product announcement, internal policy document, or draft contract - using the Elementor widget JSON via the REST API. Once the public post is saved and visited by any anonymous user, the plugin renders and serves the full content of the private page without any authorization check. …
Remediation	Update the Envo's Templates & Widgets for Elementor and WooCommerce plugin to the version released at or after SVN changeset 3578489; consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/26100f1f-3224-486c-b4f9-7086d405a883 for the confirmed patched version number, as it was not independently verifiable from the available data. … Detailed patch versions, workarounds, and compensating controls in full report.