ElementsReady Addons CVE-2026-91046

Exploitation requires an authenticated account at subscriber level or above on a WordPress site running ElementsReady Addons for Elementor through 6.7.2; the vulnerable code paths are settings-save handlers that fail to halt execution on authorization failure. Practically, an unauthenticated attacker must first be able to register (open/self-service registration enabled) to reach the subscriber threshold. Limiting factors: a valid authenticated session is mandatory (PR:L), so this is not remotely exploitable against anonymous visitors; however, no administrator privileges, no user interaction, and no non-default plugin configuration are required, and impact is confined to integrity of the plugin's stored settings (no data disclosure or availability loss).

This is a moderate, authenticated-access flaw rather than a top-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) is internally consistent with the description: network-reachable, low complexity, but requiring low-privilege (subscriber-level) authentication, with only partial integrity impact and no confidentiality or availability loss. The SSVC framework reinforces a measured posture - Exploitation: none (no observed active exploitation), Automatable: no, Technical Impact: partial - which aligns with the low CVSS. The main escalating signal is that publicly available exploit code exists (WPScan), lowering the skill barrier, but this is distinct from active exploitation and the CVE is NOT in CISA KEV. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one meaningful caveat: although the integrity impact is scored 'Low', the flaw permits overwriting stored API credentials and feature/template configuration, which could in some deployments enable follow-on abuse (e.g., redirecting integrations) beyond what a Low rating suggests - worth noting but not a reason to override the vector. Net: a real but low-urgency issue, prioritize behind unauthenticated or KEV-listed vulnerabilities.

An attacker registers or obtains a low-privilege (subscriber) account on a WordPress site running ElementsReady Addons for Elementor (≤6.7.2), then sends a crafted request directly to one of the plugin's settings-save handlers that omits authorization checks. Because publicly available exploit code exists, the attacker can overwrite stored plugin settings - including API credentials and feature/template configuration - without needing administrator rights or user interaction.