What is the CVSS score of CVE-2026-7665?

CVE-2026-7665 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Essential Addons for Elementor CVE-2026-7665

EUVD-2026-34950 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-06 Wordfence

GHSA-vr7v-hp4j-6h8g

WordPress Authentication Bypass Information Disclosure Wordpress Plugin Essential Addons For Elementor Popular Elementor Templates Widgets Wpdevteam

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 03:55 vuln.today

CVE Published

Jun 06, 2026 - 02:28 nvd

MEDIUM 5.3

DescriptionCVE.org

The Essential Addons for Elementor - Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

AnalysisAI

Information exposure in Essential Addons for Elementor (all versions ≤ 6.6.4) allows unauthenticated remote attackers to extract content from password-protected, private, and draft WordPress posts via the plugin's ajax_load_more AJAX endpoint. The root cause (CWE-639) is that user-controlled query parameters are accepted without enforcing WordPress native post-visibility access controls, bypassing the platform's built-in confidentiality model. No public exploit code has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface on one of the most widely deployed Elementor add-ons makes this a realistic target for automated scanning campaigns.

Technical ContextAI

The affected component is the ajax_load_more handler and related AJAX callbacks within includes/Traits/Ajax_Handler.php of the Essential Addons for Elementor plugin (CPE: cpe:2.3:a:wpdevteam:essential_addons_for_elementor_-_popular_elementor_templates_&_widgets:*:*:*:*:*:*:*:*). CWE-639 (Authorization Bypass Through User-Controlled Key) is the root cause class: the AJAX handler accepts attacker-supplied parameters - likely post IDs, post_status filters, or query arguments - and constructs WP_Query calls without enforcing WordPress post visibility rules. WordPress natively restricts private, draft, and password-protected posts from unauthenticated queries, but the plugin's AJAX layer bypasses these controls by permitting arbitrary parameter injection. Wordfence source references identify the flaw across at least four distinct locations in Ajax_Handler.php (lines 106, 197, 292, and 1601), confirmed vulnerable across tags 6.5.13 and 6.6.3 as well as trunk, indicating the issue spans multiple widget implementations that share the load-more pagination pattern.

RemediationAI

Upgrade Essential Addons for Elementor to version 6.6.5 or later; the fix is tied to WordPress SVN changeset 3541534 applied to the plugin's trunk, which represents the upstream patch for this issue. Important caveat: the exact released version number containing this fix is inferred from the stated vulnerable ceiling of 6.6.4 and the SVN changeset reference - it has not been independently confirmed in the provided data, so verify against the plugin's official changelog at https://wordpress.org/plugins/essential-addons-for-elementor-lite/#developers before deploying. As a compensating control prior to patching, disable Elementor widgets that use Load More or Infinite Scroll post-listing features (Post Grid, Post List, and similar) - this eliminates the exploitable AJAX surface while leaving other plugin functionality intact. A WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php carrying the eael_load_more action (or equivalent plugin-specific action names) will also mitigate exposure, though this breaks intended pagination for site visitors and requires careful testing. Monitor https://www.wordfence.com/threat-intel/vulnerabilities/id/861ece65-bee7-4124-b1a8-de9fb0c1cbc7 for confirmed patched-version details.