What is the CVSS score of CVE-2026-42629?

CVE-2026-42629 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PowerPack Pro for Elementor are affected by CVE-2026-42629?

PowerPack Pro for Elementor WordPress plugin (versions prior to 2.13.0) contains an authentication vulnerability allowing unauthorized access to website administrator functions, with no public…

How to fix or mitigate CVE-2026-42629?

Within 24 hours: Inventory all WordPress installations running PowerPack Pro and identify those with versions prior to 2.13.0. Within 7 days: Upgrade all affected installations to PowerPack Pro version 2.13.0 or later and verify authentication controls are functioning. Within 30 days: Audit access logs and administrator accounts for unauthorized activity during the vulnerable period and strengthen access monitoring controls.

PowerPack Pro for Elementor CVE-2026-42629

EUVD-2026-37609 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-17 Patchstack

Information Disclosure Powerpack Pro For Elementor Elementor

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint, no attacker auth (PR:N), but victim must visit a crafted link (UI:R); auth bypass yields full CIA impact on the site.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:09 vuln.today

DescriptionCVE.org

Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.

AnalysisAI

Authentication bypass in the PowerPack Pro for Elementor WordPress plugin (versions prior to 2.13.0) allows remote attackers to subvert authentication controls and gain unauthorized access with high impact to confidentiality, integrity, and availability. The flaw, reported by Patchstack and tracked as CVE-2026-42629, is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and requires user interaction per the CVSS vector. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

PowerPack Pro for Elementor is a commercial add-on plugin extending the Elementor page builder for WordPress with additional widgets, modules, and templates. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates that the plugin exposes an authentication-relevant code path that fails to enforce the normal credential or session checks - typical patterns in WordPress add-ons include AJAX handlers, REST endpoints, or shortcode-processing functions that omit nonce/capability checks and can be invoked by unauthenticated visitors. The affected CPE (cpe:2.3:a:powerpackelements:powerpack_pro_for_elementor) covers all versions below 2.13.0.

RemediationAI

Upgrade PowerPack Pro for Elementor to version 2.13.0 or later via the WordPress plugin updater or the PowerPack Elements customer portal as the primary fix, referencing the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/powerpack-elements/vulnerability/wordpress-powerpack-pro-for-elementor-plugin-v2-13-0-broken-authentication-vulnerability. Where immediate patching is not possible, deploy a WordPress WAF rule (Patchstack, Wordfence, or equivalent) to virtually patch the vulnerable endpoints, and consider temporarily deactivating the plugin - at the cost of losing the PowerPack widgets currently used in published pages, which may break layout rendering until reactivated. Additionally, restrict administrative access via IP allowlisting on /wp-admin and audit recently created administrator accounts and modified content for signs of prior exploitation, accepting that legitimate remote admin workflows will be impacted.