What is the CVSS score of EUVD-2026-27213?

EUVD-2026-27213 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

ElementsKit Elementor Addons EUVD-2026-27213

| CVE-2026-4362 MEDIUM

Missing Authorization (CWE-862)

2026-05-05 Wordfence

GHSA-w36j-ww57-r68h

Authentication Bypass WordPress Elementor

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 05:30 vuln.today

DescriptionCVE.org

The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Live_Action::reset() function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress init action and triggers when both post and action=elementor GET parameters are present, with no authentication or nonce verification. This makes it possible for unauthenticated attackers to overwrite the Elementor content (_elementor_data) of any elementskit_widget custom post type by visiting a specially crafted URL. The widget's custom designs, text, and configurations are permanently replaced with a blank template.

AnalysisAI

ElementsKit Elementor Addons plugin for WordPress versions up to 3.8.2 allows unauthenticated attackers to overwrite Elementor widget content via a missing capability check in the Live_Action::reset() function. By crafting a URL with specific GET parameters (post and action=elementor), attackers can permanently replace any elementskit_widget custom post type's design, text, and configurations with a blank template, causing data loss without requiring authentication or user interaction.

Technical ContextAI

The vulnerability stems from improper authorization in the Live_Action::reset() function, which is hooked directly to the WordPress init action without validating user capabilities or nonce tokens. This function processes GET parameters (post and action=elementor) to identify target widgets but lacks the current_user_can() capability check or wp_verify_nonce() validation required by WordPress security standards. The affected product is the ElementsKit Elementor Addons plugin (CPE: cpe:2.3:a:roxnor:elementskit_elementor_addons_-_advanced_widgets_&_templates_addons_for_elementor:*:*:*:*:*:*:*:*), which extends the Elementor page builder with custom widgets. The root cause is classified under CWE-862 (Missing Authorization), a critical authorization bypass pattern in web applications.

RemediationAI

Update ElementsKit Elementor Addons to version 3.9.0 or later immediately, which includes the patched Live_Action::reset() function with proper capability and nonce checks. If immediate patching is not possible, disable the ElementsKit plugin temporarily via WordPress admin panel or command line (wp plugin deactivate elementskit-lite). For organizations requiring continued use during patching delays, add a Web Application Firewall (WAF) rule to block HTTP requests containing both ?post= and action=elementor parameters simultaneously, or implement rate limiting on the WordPress init hook endpoint-noting that WAF rules may have false-positive impact on legitimate Elementor editing workflows and should be tested in a staging environment first. Reference the official patch notes at https://plugins.trac.wordpress.org/changeset?old_path=%2Felementskit-lite/tags/3.8.2&new_path=%2Felementskit-lite/tags/3.9.0 for detailed implementation changes.