PT-2026-28209 · WordPress · Elementor Website Builder

Angus Girvan · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-1206

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elementor Website Builder versions prior to 3.35.8

Description The Elementor Website Builder plugin for WordPress is susceptible to a flaw that allows unauthorized access to sensitive information. This is caused by a permission check error in the is allowed to read template() function, which incorrectly allows reading of non-published templates without proper edit capability verification. Authenticated attackers with contributor-level access or higher can read private or draft Elementor template content by manipulating the template id parameter within the get template data action of the elementor ajax endpoint.

Recommendations Update Elementor Website Builder to version 3.35.8 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-1206

Affected Products

Elementor Website Builder

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-1206 · Security Note
• https://plugins.trac.wordpress.org/changeset/3489160/elementor/trunk/includes/template-library/sources/local.php?old=3473768&old_path=elementor%2Ftrunk%2Fincludes%2Ftemplate-library%2Fsources%2Flocal.php · Note
• https://twitter.com/CVEnew/status/2037137736767783421 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a4420935-4952-4460-afc2-1c6df6965b3d?source=cve · Note