What is the CVSS score of EUVD-2026-16116?

EUVD-2026-16116 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-16116?

Organizations using Elementor Website Builder should be aware of moderate risk from CVE-2026-1206, a IDOR vulnerability rated CVSS 4.3.

How to fix or mitigate EUVD-2026-16116?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Incorrect Authorization to Se and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress EUVD-2026-16116

| CVE-2026-1206 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-26 Wordfence

GHSA-6963-573w-vxvf

WordPress Information Disclosure Authentication Bypass Elementor

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 06:00 euvd

EUVD-2026-16116

Analysis Generated

Mar 26, 2026 - 06:00 vuln.today

CVE Published

Mar 26, 2026 - 05:29 nvd

MEDIUM 4.3

DescriptionCVE.org

The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.

AnalysisAI

The Elementor Website Builder plugin for WordPress contains an authorization bypass vulnerability in the is_allowed_to_read_template() function that incorrectly permits authenticated users with contributor-level privileges to read private and draft template content. Attackers can exploit this through the 'get_template_data' action of the 'elementor_ajax' endpoint by supplying a 'template_id' parameter, resulting in exposure of sensitive template information. The vulnerability affects all versions up to and including 3.35.7 with a CVSS score of 4.3 (low-to-moderate severity) and requires low-complexity exploitation with authenticated access.

Technical ContextAI

The vulnerability stems from a logic error in the permission-checking function within the Elementor Website Builder plugin (CPE: cpe:2.3:a:elemntor:elementor_website_builder_-_more_than_just_a_page_builder:*:*:*:*:*:*:*:*), which affects all WordPress installations using this popular page-building plugin. The root cause is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), where the is_allowed_to_read_template() function fails to properly validate edit capabilities when checking access to non-published templates. Instead of requiring 'edit' permissions consistent with WordPress's capability hierarchy, the function treats draft and private templates as readable by any authenticated user at contributor level or above, bypassing the intended access control model. The vulnerable code path involves the 'elementor_ajax' endpoint's 'get_template_data' action, which accepts a 'template_id' parameter without sufficient authorization verification before returning template data.

RemediationAI

Immediately upgrade the Elementor Website Builder plugin to a version newer than 3.35.7, which contains the authorization logic fix in the is_allowed_to_read_template() function. WordPress administrators can update through the WordPress plugin dashboard (Plugins > Installed Plugins > Elementor > Update Now) or via command line using wp-cli. Until patching is completed, organizations should enforce additional access controls by restricting contributor-level user accounts to only necessary WordPress roles, auditing existing user permissions to remove unnecessary elevated access, and monitoring ajax requests to the elementor_ajax endpoint for suspicious template_id parameter usage. If immediate patching is impossible, consider temporarily disabling Elementor until updates are applied, or restricting admin dashboard access to trusted IP ranges through web server configuration. Review Wordfence's detailed advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a4420935-4952-4460-afc2-1c6df6965b3d?source=cve for additional guidance and indicators of compromise.