EUVD-2026-16116
GHSA-6963-573w-vxvf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.
AnalysisAI
The Elementor Website Builder plugin for WordPress contains an authorization bypass vulnerability in the is_allowed_to_read_template() function that incorrectly permits authenticated users with contributor-level privileges to read private and draft template content. Attackers can exploit this through the 'get_template_data' action of the 'elementor_ajax' endpoint by supplying a 'template_id' parameter, resulting in exposure of sensitive template information. The vulnerability affects all versions up to and including 3.35.7 with a CVSS score of 4.3 (low-to-moderate severity) and requires low-complexity exploitation with authenticated access.
Technical ContextAI
The vulnerability stems from a logic error in the permission-checking function within the Elementor Website Builder plugin (CPE: cpe:2.3:a:elemntor:elementor_website_builder_-_more_than_just_a_page_builder:*:*:*:*:*:*:*:*), which affects all WordPress installations using this popular page-building plugin. The root cause is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), where the is_allowed_to_read_template() function fails to properly validate edit capabilities when checking access to non-published templates. Instead of requiring 'edit' permissions consistent with WordPress's capability hierarchy, the function treats draft and private templates as readable by any authenticated user at contributor level or above, bypassing the intended access control model. The vulnerable code path involves the 'elementor_ajax' endpoint's 'get_template_data' action, which accepts a 'template_id' parameter without sufficient authorization verification before returning template data.
RemediationAI
Immediately upgrade the Elementor Website Builder plugin to a version newer than 3.35.7, which contains the authorization logic fix in the is_allowed_to_read_template() function. WordPress administrators can update through the WordPress plugin dashboard (Plugins > Installed Plugins > Elementor > Update Now) or via command line using wp-cli. Until patching is completed, organizations should enforce additional access controls by restricting contributor-level user accounts to only necessary WordPress roles, auditing existing user permissions to remove unnecessary elevated access, and monitoring ajax requests to the elementor_ajax endpoint for suspicious template_id parameter usage. If immediate patching is impossible, consider temporarily disabling Elementor until updates are applied, or restricting admin dashboard access to trusted IP ranges through web server configuration. Review Wordfence's detailed advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a4420935-4952-4460-afc2-1c6df6965b3d?source=cve for additional guidance and indicators of compromise.
Stored cross-site scripting in Elementor Website Builder plugin for WordPress up to version 4.0.4 allows authenticated c
Stored Cross-Site Scripting in Elementor Website Builder plugin for WordPress allows authenticated attackers with Contri
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today