EUVD-2026-45892
GHSA-v2ph-jf8x-q5mc
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Contributor is a low-privilege WordPress role (PR:L not PR:H); network-accessible REST endpoint with no interaction required; confidentiality impact is high, no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
AnalysisAI
Information disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users with Contributor-level access or above to read the title, body, and metadata of private posts, private pages, and drafts belonging to other users - including site administrators - via an improperly permission-checked REST endpoint. A publicly available proof-of-concept exploit exists (reported by WPScan), though EPSS places exploitation probability at 0.14% (4th percentile), indicating limited current in-the-wild activity despite public PoC. No active exploitation has been confirmed by CISA KEV; the vendor has released a patched version (4.1.4).
Technical ContextAI
Elementor Website Builder is a widely-used WordPress page-builder plugin (CPE: cpe:2.3:a:unknown:elementor_website_builder:*:*:*:*:*:*:*:*) that exposes REST API endpoints for its editor functionality. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause: a REST endpoint fails to enforce adequate authorization checks before returning post data, allowing the caller's WordPress role (Contributor or above) to bypass WordPress's native post-visibility controls. In WordPress, Contributor is the lowest role that can create draft content; these users are not expected to read unpublished or private content authored by others. The flaw undermines the WordPress capability system (edit_others_posts, read_private_posts), which normally restricts cross-user content access to Editor-level and above, by routing the request through Elementor's less-restrictive permission layer.
RemediationAI
The primary fix is to update Elementor Website Builder to version 4.1.4 or later, which introduces proper permission checks on the affected REST endpoint; this patch is confirmed available from the vendor. Site administrators should prioritize this update on any multi-author WordPress installation where users hold Contributor-level accounts or above. As a compensating control prior to patching, administrators can temporarily revoke Contributor-level accounts for untrusted or unknown users, though this will prevent those users from submitting drafts. Alternatively, disabling REST API access for non-administrator roles via a security plugin (e.g., restricting the affected endpoint via a capability filter) can limit exposure, with the trade-off that Elementor editor functionality for those roles may be partially impaired. References: WPScan advisory https://wpscan.com/vulnerability/d0d6b840-790d-45a3-9b0d-8f77a229e8a9/ and VulDB entry https://vuldb.com/vuln/380552.
More in Elementor Website Builder
View allA DOM-based Cross-Site Scripting (XSS) vulnerability exists in Elementor Website Builder through version 3.35.5, allowin
Sensitive data exposure in Elementor Website Builder for WordPress (versions <= 4.1.3) allows contributor-level authenti
Broken access control in Elementor Website Builder through version 3.35.5 permits high-privileged, network-based WordPre
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today