Jeg Elementor Kit EUVD-2026-100909

Exploitation requires an authenticated account at Subscriber level or above (CVSS PR:L), so the primary limiting factor is account access - sites that disable open user registration and tightly control low-privilege accounts sharply reduce exposure. The specific technical prerequisite is that the vulnerable Jeg Elementor Kit plugin (≤3.2.19) is installed and active, exposing the wp_ajax_jkit_post_block handler (registered generically via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) which mints a usable jeg_find_author nonce for any logged-in caller, and the wp_ajax_jeg_find_author handler which runs an unauthorized WP_User_Query substring search against user_email. No special non-default configuration of the plugin is needed and no victim user interaction is required (UI:N); the only gate is a low-privilege authenticated session.

This is a genuine but moderate-priority issue, not a high-urgency emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) is internally consistent with the description: network-reachable, low-complexity, requiring only PR:L (Subscriber-level authentication), with no integrity or availability impact. The signals are not conflicting but they are modest - there is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the input, so exploitation status is 'no public exploit identified at time of analysis.' The one point worth challenging is the C:H confidentiality rating: the actual leak is limited to registered usernames, display names, user IDs, and reconstructed email addresses (an oracle-based, character-by-character substring attack), which is real PII disclosure but narrower than full-database confidentiality - C:L is arguably more defensible, so treat the vendor C:H as an upper bound. The practical risk is that any site allowing open user registration hands a Subscriber account to any attacker, who can then enumerate all users and harvest admin/editor emails to seed phishing or credential-stuffing. On sites with no self-registration and few low-privilege accounts, real-world exposure is much lower. Net: patch in the normal cycle, prioritize if open registration is enabled.

An attacker registers (or is granted) a Subscriber account on a WordPress site running Jeg Elementor Kit ≤3.2.19, then calls the wp_ajax_jkit_post_block action to obtain a valid jeg_find_author nonce. Using that nonce against wp_ajax_jeg_find_author, they issue repeated WP_User_Query substring searches ('*a*', '*ab*', …) to enumerate every user and reconstruct admin email addresses one character at a time. No public exploit code is referenced, but the attack is trivially scriptable given the described handlers.