PT-2026-28209 · WordPress · Elementor Website Builder

Angus Girvan · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-1206

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elementor Website Builder versions prior to 3.35.8

Description The Elementor Website Builder plugin for WordPress is susceptible to a flaw that allows unauthorized access to sensitive information. This is caused by a permission check error in the is allowed to read template() function, which incorrectly allows reading of non-published templates without proper edit capability verification. Authenticated attackers with contributor-level access or higher can read private or draft Elementor template content by manipulating the template id parameter within the get template data action of the elementor ajax endpoint.

Recommendations Update Elementor Website Builder to version 3.35.8 or later.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-1206

Produtos afetados

Elementor Website Builder

Referências · 4

• https://plugins.trac.wordpress.org/changeset/3489160/elementor/trunk/includes/template-library/sources/local.php?old=3473768&old_path=elementor%2Ftrunk%2Fincludes%2Ftemplate-library%2Fsources%2Flocal.php · Nota
• https://twitter.com/CVEnew/status/2037137736767783421 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-1206 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/a4420935-4952-4460-afc2-1c6df6965b3d?source=cve · Nota