What is the CVSS score of CVE-2026-4362?

CVE-2026-4362 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

ElementsKit Elementor Addons CVE-2026-4362

EUVD-2026-27213 MEDIUM

Missing Authorization (CWE-862)

2026-05-05 Wordfence

GHSA-w36j-ww57-r68h

WordPress Authentication Bypass Elementskit Elementor Addons Advanced Widgets Templates Addons For Elementor Wordpress Plugin Elementor Roxnor

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 05:30 vuln.today

DescriptionCVE.org

The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Live_Action::reset() function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress init action and triggers when both post and action=elementor GET parameters are present, with no authentication or nonce verification. This makes it possible for unauthenticated attackers to overwrite the Elementor content (_elementor_data) of any elementskit_widget custom post type by visiting a specially crafted URL. The widget's custom designs, text, and configurations are permanently replaced with a blank template.

AnalysisAI

ElementsKit Elementor Addons plugin for WordPress versions up to 3.8.2 allows unauthenticated attackers to overwrite Elementor widget content via a missing capability check in the Live_Action::reset() function. By crafting a URL with specific GET parameters (post and action=elementor), attackers can permanently replace any elementskit_widget custom post type's design, text, and configurations with a blank template, causing data loss without requiring authentication or user interaction.

Technical ContextAI

The vulnerability stems from improper authorization in the Live_Action::reset() function, which is hooked directly to the WordPress init action without validating user capabilities or nonce tokens. This function processes GET parameters (post and action=elementor) to identify target widgets but lacks the current_user_can() capability check or wp_verify_nonce() validation required by WordPress security standards. The affected product is the ElementsKit Elementor Addons plugin (CPE: cpe:2.3:a:roxnor:elementskit_elementor_addons_-_advanced_widgets_&_templates_addons_for_elementor:*:*:*:*:*:*:*:*), which extends the Elementor page builder with custom widgets. The root cause is classified under CWE-862 (Missing Authorization), a critical authorization bypass pattern in web applications.

RemediationAI

Update ElementsKit Elementor Addons to version 3.9.0 or later immediately, which includes the patched Live_Action::reset() function with proper capability and nonce checks. If immediate patching is not possible, disable the ElementsKit plugin temporarily via WordPress admin panel or command line (wp plugin deactivate elementskit-lite). For organizations requiring continued use during patching delays, add a Web Application Firewall (WAF) rule to block HTTP requests containing both ?post= and action=elementor parameters simultaneously, or implement rate limiting on the WordPress init hook endpoint-noting that WAF rules may have false-positive impact on legitimate Elementor editing workflows and should be tested in a staging environment first. Reference the official patch notes at https://plugins.trac.wordpress.org/changeset?old_path=%2Felementskit-lite/tags/3.8.2&new_path=%2Felementskit-lite/tags/3.9.0 for detailed implementation changes.