Essential Addons EUVD-2026-111712

Requires a WordPress site running Essential Addons for Elementor prior to 6.8.7 with the plugin's pagination endpoint (its 'load more'/AJAX pagination functionality) reachable, which it is by default for unauthenticated visitors - the vector matches AV:N/AC:L/PR:N/UI:N, meaning no authentication, no special configuration, and no user interaction. The concrete prerequisite is that the attacker can pass unrestricted post_type and meta_query parameters to that pagination endpoint. Exploitation is naturally limited in scope: private custom-field values are only recoverable on published posts, the impact is read-only disclosure (C:L, no integrity/availability effect), and the actual value exposed depends on what non-public post types and private meta fields a given site actually stores.

This is a moderate, information-disclosure issue that should be scheduled rather than treated as an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:L/I:N/A:N, score 5.3) describes a network-reachable, low-complexity, unauthenticated read-only leak with no integrity or availability impact, which matches the description precisely (unauthenticated visitor coerces the pagination endpoint into returning non-public post content and private custom-field values). The exploitation signals argue against urgency: EPSS is 0.16% (5th percentile), the CVE is NOT on CISA KEV, and no POC or exploit reference beyond the WPScan advisory and NVD entries is supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', consistent with a real but non-critical priority. The signals are internally consistent - there is no conflict between the network vector and the description, both point to remote unauthenticated access. The main thing elevating practical risk above the modest CVSS number is product reach: Essential Addons for Elementor is one of the most-installed Elementor add-ons, so a large install base is exposed even though per-site impact is a bounded confidentiality leak. Treat as a scheduled patching item: no privileged access, no user interaction, and widely deployed, but impact is limited to disclosure of private field/post data, not code execution or takeover.

An unauthenticated attacker sends crafted requests to the plugin's pagination (load-more) endpoint, supplying arbitrary post_type and meta_query parameters that the plugin fails to restrict. The endpoint then returns content from non-public post types and the values of private custom fields attached to published posts, letting the attacker harvest data never intended to be public. No POC is provided in the input; the low attack complexity (AC:L) and lack of required privileges or interaction make opportunistic scraping straightforward if a working request is constructed.