PT-2026-28209 · Elementor · Elementor Website Builder – More Than Just A Page Builder

Angus Girvan · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-1206

NVD

CVSS v3.1

4.3

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is allowed to read template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template id' supplied to the 'get template data' action of the 'elementor ajax' endpoint.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-1206

Affected Products

Elementor Website Builder – More Than Just A Page Builder

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-1206 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a4420935-4952-4460-afc2-1c6df6965b3d?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3489160/elementor/trunk/includes/template-library/sources/local.php?old=3473768&old_path=elementor%2Ftrunk%2Fincludes%2Ftemplate-library%2Fsources%2Flocal.php · Note