EUVD-2026-11989Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
High privilege required reflects mandatory WordPress admin-level authentication; integrity-only low impact with no scope change matches a bounded unauthorized modification with no data exposure.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.
AnalysisAI
Broken access control in Elementor Website Builder through version 3.35.5 permits high-privileged, network-based WordPress users to exceed their intended authorization boundaries by exploiting incorrectly configured access control security levels. The missing authorization checks (CWE-862) allow a scoped integrity modification - no confidentiality or availability impact is indicated. With a CVSS score of 2.7 (Low), EPSS at 0.02% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this vulnerability presents low urgency in practice despite the widespread deployment footprint of the plugin.
Technical ContextAI
The affected product is the Elementor Website Builder WordPress plugin (CPE: cpe:2.3:a:elementor:elementor_website_builder:*:*:*:*:*:*:*:*), one of the most widely used drag-and-drop page builders in the WordPress ecosystem. CWE-862 (Missing Authorization) identifies the root cause: the plugin fails to enforce adequate server-side access control checks on one or more endpoints or actions, allowing authenticated requests that should be restricted by role or capability to proceed unchallenged. This falls under the broader OWASP Broken Access Control category, where the application trusts role declarations or UI-level restrictions without validating them server-side. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) indicates the flaw is reachable over the network without user interaction, but requires high-privilege credentials - suggesting the bypass elevates or misuses an already-privileged role rather than granting access to unauthenticated users.
RemediationAI
The primary remediation is to upgrade Elementor Website Builder beyond version 3.35.5; the exact fixed release version is not confirmed in the available data - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-3-35-5-broken-access-control-vulnerability for the confirmed patched version before upgrading. Until patching is possible, restrict WordPress administrative backend access to trusted IP ranges via server-level controls (e.g., nginx or Apache allow/deny directives, or a WAF rule), which eliminates the AV:N attack path entirely at the cost of remote admin flexibility. Additionally, audit and reduce the number of high-privileged WordPress accounts to the minimum necessary, directly shrinking the exploitable account surface given the PR:H requirement. Enforcing least-privilege role assignments within the Elementor plugin settings may also limit the scope of what any bypass could modify.
More in Elementor Website Builder
View allInformation disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users wit
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Elementor Website Builder through version 3.35.5, allowin
Sensitive data exposure in Elementor Website Builder for WordPress (versions <= 4.1.3) allows contributor-level authenti
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today