EUVD-2026-25196
GHSA-fjqg-327f-q6hw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated AJAX endpoint; confidentiality impact is limited to partial exposure of non-financial customer geographic data with no integrity or availability consequence.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days
AnalysisAI
HT Mega Addons for Elementor WordPress plugin before version 3.0.7 leaks customer PII through an unauthenticated AJAX endpoint, exposing full name, city, state, and country for any orders placed in the prior 7 days. Any remote unauthenticated attacker can query this endpoint without credentials on affected WordPress installations. A public proof-of-concept is available and SSVC classifies the attack as automatable, enabling mass scanning of exposed WooCommerce stores; however, the EPSS score of 0.77% suggests exploitation has not yet become widespread.
Technical ContextAI
The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). HT Mega Addons is a WordPress plugin extending the Elementor page builder with additional widgets, commonly paired with WooCommerce for e-commerce sites. The flaw resides in an AJAX action handler registered without authentication checks - in WordPress, AJAX endpoints accessible to unauthenticated users are registered via the wp_ajax_nopriv_ hook. This action queries WooCommerce order data and returns customer PII in its response without verifying the requestor's identity or authorization. The CPE cpe:2.3:a:unknown:ht_mega_addons_for_elementor:*:*:*:*:*:*:*:* covers all versions up to but not including 3.0.7.
RemediationAI
Update HT Mega Addons for Elementor to version 3.0.7 or later, which is confirmed as the patched release per the WPScan advisory at https://wpscan.com/vulnerability/9477ead2-3990-4aae-8e66-09ee2f4daa3e/ and VulDB entry https://vuldb.com/vuln/359121. If immediate patching is not possible, a compensating control is to use a web application firewall rule to block unauthenticated POST requests to wp-admin/admin-ajax.php that reference the specific vulnerable action name (which can be identified from the POC); note this may break legitimate plugin functionality. Alternatively, temporarily deactivating the HT Mega Addons plugin eliminates the attack surface entirely but will disable all associated Elementor widgets on the site.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today