PT-2026-3237 · WordPress+1 · Essential Addons For Elementor+1

Shrikant Bhosale · Published 2026-01-16 · Updated 2026-01-16 · CVE-2026-1004

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor plugin for WordPress versions through 6.5.5

Description The Essential Addons for Elementor plugin for WordPress is susceptible to exposure of sensitive information. An unauthenticated attacker can retrieve WooCommerce product information, including products with draft, pending, or private status, which should normally be restricted. This is possible through the eael product quickview popup function.

Recommendations Update the Essential Addons for Elementor plugin to a version later than 6.5.5.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1004

Affected Products

Elementor

Essential Addons For Elementor

References · 11

• https://osv.dev/vulnerability/CVE-2026-1004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1004 · Security Note
• https://github.com/WPDevelopers/essential-addons-for-elementor-lite/commit/4e43db06bcf12870cc3b185ed59b3fe2cd227945 · Note
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L1439 · Note
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L64 · Note
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L832 · Note
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L65 · Note
• https://twitter.com/VulmonFeeds/status/2012173910830153894 · Twitter Post
• https://twitter.com/CVEnew/status/2012126432562913538 · Twitter Post
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L820 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/06ef9a21-e2b9-40c7-9de5-cff175fa10a5?source=cve · Note