PT-2026-32365 · Undefined · Undefined

Chiao-Lin Yu · Published 2026-04-13 · Updated 2026-04-23 · CVE-2026-4106

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HT Mega Addons for Elementor versions prior to 3.0.7

Description An unauthenticated AJAX action allows the exposure of personally identifiable information (PII), including full name, city, state, and country, of customers who have placed orders within the last 7 days.

Recommendations Update to version 3.0.7 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-4106

Affected Products

Undefined

References · 4

• 🔥 https://wpscan.com/vulnerability/9477ead2-3990-4aae-8e66-09ee2f4daa3e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4106 · Security Note
• https://twitter.com/pdnuclei_bot/status/2043660503919276392 · Twitter Post
• https://twitter.com/CVEnew/status/2047359877190705188 · Twitter Post