PT-2026-3237 · WordPress+1 · Essential Addons For Elementor+1

Shrikant Bhosale · Publicado 2026-01-16 · Atualizado 2026-01-16 · CVE-2026-1004

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor plugin for WordPress versions through 6.5.5

Description The Essential Addons for Elementor plugin for WordPress is susceptible to exposure of sensitive information. An unauthenticated attacker can retrieve WooCommerce product information, including products with draft, pending, or private status, which should normally be restricted. This is possible through the eael product quickview popup function.

Recommendations Update the Essential Addons for Elementor plugin to a version later than 6.5.5.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1004

Produtos afetados

Elementor

Essential Addons For Elementor

Referências · 11

• https://github.com/WPDevelopers/essential-addons-for-elementor-lite/commit/4e43db06bcf12870cc3b185ed59b3fe2cd227945 · Nota
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L1439 · Nota
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L64 · Nota
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L832 · Nota
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L65 · Nota
• https://twitter.com/VulmonFeeds/status/2012173910830153894 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-1004 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2012126432562913538 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L820 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/06ef9a21-e2b9-40c7-9de5-cff175fa10a5?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1004 · Nota de Segurança