PT-2026-8224 · WordPress+1 · Element Pack Elementor Addons+1

Chiao-Lin Yu · Publicado 2026-02-15 · Atualizado 2026-02-15 · CVE-2026-1793

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Element Pack Addons for Elementor versions prior to 8.3.18

Description The Element Pack Addons for Elementor plugin for WordPress contains a flaw that allows authenticated attackers with contributor-level access or higher to read arbitrary files on the server. This is possible due to insufficient file validation within the render svg function when using the SVG widget. The issue could expose sensitive information contained in these files.

Recommendations Update Element Pack Addons for Elementor to version 8.3.18 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-1793

Produtos afetados

Element Pack Elementor Addons

Elementor

Referências · 10

• https://t.me/CVEtracker/44749 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2022892439178969147 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2023020360833311102 · Publicação no Twitter
• https://t.me/cveNotify/152051 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2022896278787514417 · Publicação no Twitter
• https://twitter.com/offseq/status/2022951560163004923 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.3.16/modules/svg-image/widgets/svg-image.php#L850 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1793 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3452826/bdthemes-element-pack-lite#file1135 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/58f9bef5-6596-40b2-bcb6-d686e87d8d8f?source=cve · Nota