What is the CVSS score of CVE-2026-4326?

CVE-2026-4326 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Vertex Addons For Elementor are affected by CVE-2026-4326?

Vertex Addons for Elementor (WordPress plugin versions ≤1.6.4) contains an authorization bypass allowing subscriber-level users to install and activate arbitrary plugins, potentially compromising…

How to fix or mitigate CVE-2026-4326?

Within 24 hours: Audit installed version of Vertex Addons for Elementor across all WordPress instances and document current version. Within 7 days: Disable or remove Vertex Addons for Elementor plugin if running version 1.6.4 or earlier; consider alternative Elementor addons from verified vendors. Within 30 days: Monitor vendor advisories and security channels for patched versions; upon availability, update immediately and re-enable only after validating plugin functionality in staging environment.

Vertex Addons For Elementor CVE-2026-4326

EUVD-2026-20825 HIGH

Missing Authorization (CWE-862)

2026-04-09 Wordfence

WordPress Authentication Bypass Vertex Addons For Elementor

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 09, 2026 - 02:15 euvd

EUVD-2026-20825

Analysis Generated

Apr 09, 2026 - 02:15 vuln.today

CVE Published

Apr 09, 2026 - 01:25 nvd

HIGH 8.8

DescriptionCVE.org

The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. This is due to improper authorization enforcement in the activate_required_plugins() function. Specifically, the current_user_can('install_plugins') capability check does not terminate execution when it fails - it only sets an error message variable while allowing the plugin installation and activation code to execute. The error response is only sent after the installation and activation have already completed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins from the WordPress.

AnalysisAI

Missing authorization bypass in Vertex Addons for Elementor (WordPress plugin, all versions ≤1.6.4) allows authenticated attackers with Subscriber-level privileges to install and activate arbitrary WordPress plugins. The activate_required_plugins() function checks current_user_can('install_plugins') capability but fails to halt execution on denial, permitting installation/activation to proceed before error response is sent. CVSS 8.8 (High) reflects authenticated (PR:L) network attack enabling high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.

Technical ContextAI

CWE-862 (Missing Authorization) arises from non-blocking capability check in Ajax.php activate_required_plugins() function. Code sets error message variable when current_user_can('install_plugins') fails but continues execution of plugin installation/activation logic before sending error response (lines 229-278 per Trac references). Low-privilege roles (Subscriber+) inherit network-accessible Ajax handler without proper access control termination, enabling unauthorized plugin manipulation via WordPress repository.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. Vendor committed changeset 3491143 addressing authorization enforcement in Ajax.php (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3491143%40addons-for-elementor-builder&new=3491143%40addons-for-elementor-builder&sfp_email=&sfph_mail=). Monitor WordPress plugin repository for version 1.6.5 or later incorporating this fix. Immediately audit installed plugins for unauthorized additions, review Subscriber-level accounts for compromise indicators, and restrict Subscriber role permissions via user role editor plugins. If patch unavailable, deactivate Vertex Addons for Elementor until vendor releases confirmed secure version. Consult Wordfence threat intelligence advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb409f0-ccbd-4dfa-b097-b29ee539daa3?source=cve for additional mitigation guidance.