What is the CVSS score of EUVD-2026-51012?

EUVD-2026-51012 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for EUVD-2026-51012?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51012. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for EUVD-2026-51012?

Yes, a patch is available for EUVD-2026-51012. Update the affected software to the latest version immediately.

Essential Addons for Elementor EUVD-2026-51012

| CVE-2026-13345 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-30 WPScan

GHSA-vmp7-rm2p-637r

WordPress Authentication Bypass Essential Addons For Elementor Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint (AV:N, PR:N, AC:L); impact limited to partial metadata disclosure only (C:L); no write, delete, or availability consequence (I:N, A:N); scope unchanged (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:46 vuln.today

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.

AnalysisAI

Unauthenticated information disclosure in Essential Addons for Elementor (WordPress plugin, all versions before 6.6.10) exposes WooCommerce product metadata - title, price, and SKU - for products in draft, pending, and private status that WordPress would otherwise withhold from public visitors. The plugin's product-comparison feature resolves product objects without performing authorization, post-status, or visibility checks, violating object-level access control (CWE-639). A public proof-of-concept exists per WPScan (the original reporter), and SSVC marks the flaw as automatable, though EPSS remains very low (0.15%) and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Essential Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional widgets, including a WooCommerce product-comparison widget. WordPress enforces access control on post objects by checking publication status (draft, pending, private) and user capability before surfacing content - this enforcement is the standard gate that prevents unauthenticated users from viewing non-public content. The vulnerable component bypasses this gate entirely: when the comparison feature resolves a WooCommerce product by ID (a user-controlled key), it does not invoke WordPress capability checks or verify post visibility, which is the canonical pattern described by CWE-639 (Authorization Bypass Through User-Controlled Key). The affected CPE is cpe:2.3:a:unknown:essential_addons_for_elementor:*:*:*:*:*:*:*:* covering all versions before 6.6.10. The 'unknown' vendor field in the CPE is a minor NVD data-quality gap and does not affect product identification.

RemediationAI

Upgrade Essential Addons for Elementor to version 6.6.10 or later, which is the vendor-released fix per WPScan and EUVD data. The update is available through the standard WordPress plugin dashboard or directly from the WordPress plugin repository. If an immediate upgrade is operationally blocked, disable the WooCommerce product-comparison widget within the plugin's feature settings - this removes the vulnerable endpoint from public exposure with no side effects beyond loss of the comparison UI for visitors. As a secondary compensating control, a WAF rule blocking unauthenticated requests to the specific AJAX action hook used by the comparison feature can reduce exposure, though the exact action name should be confirmed from the WPScan advisory before deployment to avoid unintended breakage. Advisory references: WPScan (https://wpscan.com/vulnerability/45937bce-12db-4770-9f15-606c62469f6d/), NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-13345), VulDB (https://vuldb.com/vuln/384593).