What is the CVSS score of CVE-2026-57619?

CVE-2026-57619 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Elementor Website Builder CVE-2026-57619

EUVD-2026-39361 MEDIUM

Missing Authorization (CWE-862)

2026-06-25 Patchstack

GHSA-xmcv-qgcf-rfp5

WordPress Authentication Bypass Information Disclosure Elementor Website Builder Wordpress Plugin Elementor

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible, low complexity, contributor authentication required (PR:L); confidentiality-only impact with no integrity or availability effect confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:36 vuln.today

DescriptionCVE.org

Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.

AnalysisAI

Sensitive data exposure in Elementor Website Builder for WordPress (versions <= 4.1.3) allows contributor-level authenticated users to access protected information due to missing authorization checks (CWE-862). The vulnerability stems from insufficient capability verification before exposing sensitive data to lower-privileged roles, enabling a contributor to retrieve data they should not have access to. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a meaningful risk on any site with untrusted contributor accounts.

Technical ContextAI

Elementor Website Builder is a widely-deployed WordPress page-builder plugin (CPE: cpe:2.3:a:elementor:elementor_website_builder:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization): a code path within the plugin returns sensitive data without first verifying whether the requesting user holds a sufficient WordPress capability. In the WordPress role model, Contributors are low-trust accounts that can draft posts but cannot publish or manage site settings. When a privileged endpoint or AJAX handler omits a capability check (e.g., current_user_can()), any authenticated user - including contributors - can invoke it and receive the sensitive payload. This class of flaw is common in WordPress plugins where REST API routes or admin-ajax handlers are registered without nonce or capability enforcement.

RemediationAI

Update Elementor Website Builder to a version beyond 4.1.3 immediately; the affected version ceiling of 4.1.3 implies a patched release follows, though an explicit patched version number was not independently confirmed in the available data - verify the latest release via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-1-3-sensitive-data-exposure-vulnerability. As a compensating control where patching is not immediately possible, restrict contributor account creation to trusted individuals only and audit existing contributor accounts for necessity, since the vulnerability requires an authenticated contributor session. Disabling public user registration (Settings > General > Membership in WordPress) removes the self-registration attack path but does not eliminate risk from existing contributor accounts. These controls reduce exposure but do not eliminate the underlying flaw.