EUVD-2026-48114
GHSA-x5qp-435v-wjj4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable unauthenticated endpoint with no complexity; impact limited to partial confidentiality, no integrity or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
AnalysisAI
Sensitive data exposure in Ultimate Store Kit Elementor Addons (by BDThemes) versions up to and including 3.0.5 permits unauthenticated remote access to restricted system or application data. The vulnerability is reachable over the network with no credentials, no user interaction, and no special configuration, placing every WordPress installation running the affected plugin version at risk of information leakage. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided, but the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) means opportunistic scanning is a realistic threat.
Technical ContextAI
Ultimate Store Kit Elementor Addons is a WordPress plugin developed by BDThemes (CPE: cpe:2.3:a:bdthemes:ultimate_store_kit_elementor_addons:*:*:*:*:*:*:*:*) that provides WooCommerce-oriented widgets and store templates for the Elementor page builder. The root cause is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), which describes a flaw where internal, implementation-level, or configuration data - such as filesystem paths, plugin options, API credentials, or debug output - is returned to a caller who should not have access to it. In the WordPress ecosystem this typically manifests as an unprotected REST API endpoint, an AJAX action registered without a capability check, or a shortcode/widget that renders privileged metadata to unauthenticated page visitors. The Elementor addon architecture is particularly susceptible because widget render callbacks and REST routes can be registered with broad visibility by default.
RemediationAI
Update the Ultimate Store Kit Elementor Addons plugin to a version released after 3.0.5 via the WordPress dashboard (Plugins → Updates) or by downloading a patched release from the WordPress plugin repository. Patch availability is confirmed per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ultimate-store-kit/vulnerability/wordpress-ultimate-store-kit-elementor-addons-plugin-3-0-5-sensitive-data-exposure-vulnerability; however, the exact patched version number is not explicitly stated in the provided input data and should be verified against the WordPress.org plugin changelog before deployment. As an interim compensating control, site administrators who cannot immediately update should consider using a Web Application Firewall (WAF) rule to block unauthenticated access to the specific REST or AJAX endpoints exposed by the plugin - note this may break legitimate plugin functionality. Disabling the plugin entirely until patched is the safest short-term control with the obvious trade-off of losing store-kit widget functionality.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today