What is the CVSS score of CVE-2026-13345?

CVE-2026-13345 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-13345?

Yes, a public proof-of-concept exploit is available for CVE-2026-13345. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-13345?

Yes, a patch is available for CVE-2026-13345. Update the affected software to the latest version immediately.

Essential Addons for Elementor CVE-2026-13345

EUVD-2026-51012 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-30 WPScan

GHSA-vmp7-rm2p-637r

WordPress Authentication Bypass Essential Addons For Elementor

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint (AV:N, PR:N, AC:L); impact limited to partial metadata disclosure only (C:L); no write, delete, or availability consequence (I:N, A:N); scope unchanged (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:46 vuln.today

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.

AnalysisAI

Unauthenticated information disclosure in Essential Addons for Elementor (WordPress plugin, all versions before 6.6.10) exposes WooCommerce product metadata - title, price, and SKU - for products in draft, pending, and private status that WordPress would otherwise withhold from public visitors. The plugin's product-comparison feature resolves product objects without performing authorization, post-status, or visibility checks, violating object-level access control (CWE-639). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site with Essential Addons for Elementor installed

Delivery

Enumerate WooCommerce product IDs via comparison endpoint

Exploit

Request draft or private product by ID without authentication

Execution

Receive disclosed product title, price, and SKU

Impact

Aggregate non-public product intelligence at scale

Access

Identify WordPress site with Essential Addons for Elementor installed

Delivery

Enumerate WooCommerce product IDs via comparison endpoint

Exploit

Request draft or private product by ID without authentication

Execution

Receive disclosed product title, price, and SKU

Impact

Aggregate non-public product intelligence at scale

Vulnerability AssessmentAI

Exploitation	Exploitation requires the Essential Addons for Elementor plugin to be installed and active at a version below 6.6.10 on the target WordPress site, and at least one WooCommerce product must exist in draft, pending, or private status for any sensitive data to be disclosed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately characterizes this as a remotely exploitable, unauthenticated, low-complexity flaw with a narrow confidentiality impact and no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends crafted HTTP requests to the WooCommerce product-comparison AJAX endpoint on a vulnerable WordPress site, supplying product IDs for items in draft, pending, or private status - IDs enumerable via sequential guessing or OSINT. The plugin returns product title, price, and SKU without enforcing visibility restrictions, enabling competitive intelligence gathering on unreleased products. …
Remediation	Upgrade Essential Addons for Elementor to version 6.6.10 or later, which is the vendor-released fix per WPScan and EUVD data. … Detailed patch versions, workarounds, and compensating controls in full report.