PT-2026-20387 · Elementor+1 · Elementor+1

Dmitry Ignatyev · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-2386

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress versions through 6.4.7

Description The software contains an authorization flaw. The tpae create page() AJAX handler only verifies that users have the 'edit posts' capability, but it directly uses a user-supplied post type value in the wp insert post() function without checking for post-type-specific permissions. This allows authenticated attackers with Author-level access or higher to create draft posts for restricted post types, such as 'page' and 'nxt builder', by manipulating the post type parameter.

Recommendations Update The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress to a version later than 6.4.7.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-2386

Affected Products

Elementor

The Plus Addons For Elementor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-2386 · Security Note
• https://plugins.trac.wordpress.org/changeset/3463156/the-plus-addons-for-elementor-page-builder · Note
• https://twitter.com/CVEnew/status/2024104653248446688 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4fc3e24a-8b51-4b6f-bacf-665ceb03bc05?source=cve · Note