Elementor Website Builder CVE-2026-57619

Requires an authenticated WordPress session with at minimum contributor role privileges (PR:L in the CVSS vector). The vulnerability is not exploitable by unauthenticated visitors. Sites that allow open user registration with automatic contributor role assignment face broader exposure, as any self-registered user could exploit this. Sites that restrict contributor accounts to vetted individuals significantly reduce real-world risk. No specific non-default plugin configuration or feature-flag is documented as required - the flaw appears to reside in functionality accessible to all contributors by default in affected versions. Exploitation is limited to confidentiality impact only; no write or denial-of-service capability is indicated.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the core risk profile: network-exploitable with no interaction required, but gated behind a low-privilege account. The high confidentiality impact (C:H) indicates the exposed data is meaningful - not merely metadata. Attack complexity is low (AC:L), meaning exploitation requires no special conditions beyond holding a contributor account. There is no integrity or availability impact (I:N/A:N), so damage is limited to information disclosure. No CISA KEV listing and no public POC have been identified, which reduces urgency somewhat. However, contributor accounts are routinely present on multi-author WordPress sites (blogs, news sites, agencies), making the effective attack surface broader than administrator-only vulnerabilities. EPSS data was not provided; absent that signal, the combination of low complexity and contributor-accessible attack path warrants prompt patching on sites with untrusted or externally-registered contributors.

An attacker registers or compromises a contributor-level account on a target WordPress site running Elementor <= 4.1.3. They then send a crafted authenticated request - likely to an Elementor AJAX handler or REST endpoint - that the plugin services without verifying the caller's capabilities, returning sensitive data such as configuration details, private post content, or user information. No public POC exists at time of analysis, but the low complexity and standard WordPress tooling make this straightforward to develop independently.