Elementor Website Builder EUVD-2026-101863

Requires an authenticated WordPress account with contributor-level capabilities or higher (CVSS PR:L) on a site running Elementor Website Builder ≤4.2.3; exploitation targets the plugin's wp-rest post-query module via the 'keys_conversion_map' parameter and works against default configurations (no special plugin setting must be enabled). The primary limiting factor is the account prerequisite: sites that do not grant untrusted users contributor accounts face low practical risk, while open-registration, membership, or multi-author sites that hand out contributor roles are materially exposed. No user interaction and no victim-side configuration is needed beyond the vulnerable plugin version.

This is a moderate, authorization-gap issue (CWE-862, Missing Authorization) rather than a high-urgency flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the description: network-reachable REST endpoint, low attack complexity, and - critically - PR:L, meaning a legitimate authenticated account (contributor-level or above) is required. There is no integrity or availability impact; the sole effect is confidentiality disclosure of other authors' private/draft/pending/future post content and plaintext post passwords. No EPSS score, KEV listing, or public POC was supplied in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the signals - the low C:L and PR:L together correctly cap this below the critical tier. The main caveat is that the required-privilege barrier (an attacker must already hold a contributor account) is the dominant real-world mitigant; on sites that freely grant contributor accounts (e.g., multi-author or membership blogs) the practical exposure is meaningfully higher than the raw score implies. Verify the fixed version directly with Wordfence/the plugin changelog, as the input only confirms 'affected up to and including 4.2.3.'

An attacker who already holds (or self-registers into) a contributor-level account on a WordPress site running Elementor ≤4.2.3 sends crafted requests to the plugin's wp-rest post-query endpoint, abusing the 'keys_conversion_map' parameter to defeat the post-visibility authorization check. The response leaks the full post_content and plaintext post_password of private, draft, pending, and future posts owned by other users, including Administrators and Editors. No public exploit code was identified in the provided data, so this would require the attacker to reproduce the technique from the vendor advisory or source references.