Jeg Kit for Elementor EUVD-2026-51740

Exploitation requires an authenticated WordPress session with Contributor-level access or above - the CVSS vector PR:L confirms a low-privilege authenticated user is sufficient, and unauthenticated exploitation is not possible. The vulnerable code path executes when the user visits the post.php admin page (the WordPress post/page editor), which is accessible to all users who can edit posts. Mailchimp API key exposure specifically requires the site operator to have configured the Mailchimp integration within the Jeg Kit plugin settings (jkit_user_data); sites without this integration still expose plugin inventory and system environment data but not third-party credentials. Exploitation is limited to the WordPress admin area and requires an active authenticated browser session. No specific server configuration, non-default plugin settings, or unusual deployment mode is required beyond the Mailchimp integration for the most severe credential-theft scenario.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N scores 4.3 (Medium), which is broadly appropriate but understates risk for sites with active Mailchimp integrations. The PR:L requirement is the primary limiting factor - unauthenticated exploitation is not possible, and attackers must possess or compromise a Contributor account. However, Contributor is among the most commonly granted non-admin roles on WordPress sites (freelancers, guest bloggers, content editors), making this a realistic threat in multi-author environments. No KEV listing confirms active exploitation, and no public POC exploit was identified at time of analysis. EPSS data was not provided in source intelligence; given the authenticated requirement and the niche plugin footprint, opportunistic mass exploitation is unlikely. The most significant real-world risk is credential theft of a Mailchimp API key, which can enable unauthorized access to a site's email subscriber lists, campaign data, and sending capabilities - an impact materially worse than generic plugin enumeration. Plugin version fingerprinting also enables targeted follow-on attacks by identifying co-installed vulnerable plugins. Defenders should treat sites with Mailchimp integration configured in this plugin as higher priority than CVSS alone indicates.

An attacker who holds or has compromised a Contributor-level WordPress account logs into the target site's admin panel and navigates to the post editor (/wp-admin/post.php). By viewing the page source or using browser developer tools to inspect inline scripts, the attacker locates the JkitDashboardOption JavaScript object and extracts the Mailchimp API key from the jkit_user_data field, then uses it to access the site's Mailchimp account and exfiltrate subscriber lists. Separately, the enumerated plugin names and versions allow the attacker to cross-reference against known vulnerability databases to identify additional exploitable plugins installed on the site.