PT-2026-8224 · WordPress+1 · Element Pack Elementor Addons+1

Chiao-Lin Yu · Published 2026-02-15 · Updated 2026-02-15 · CVE-2026-1793

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Element Pack Addons for Elementor versions prior to 8.3.18

Description The Element Pack Addons for Elementor plugin for WordPress contains a flaw that allows authenticated attackers with contributor-level access or higher to read arbitrary files on the server. This is possible due to insufficient file validation within the render svg function when using the SVG widget. The issue could expose sensitive information contained in these files.

Recommendations Update Element Pack Addons for Elementor to version 8.3.18 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-1793

Affected Products

Element Pack Elementor Addons

Elementor

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-1793 · Security Note
• https://t.me/CVEtracker/44749 · Telegram Post
• https://twitter.com/CVEnew/status/2022892439178969147 · Twitter Post
• https://twitter.com/CVEarity/status/2023020360833311102 · Twitter Post
• https://t.me/cveNotify/152051 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2022896278787514417 · Twitter Post
• https://twitter.com/offseq/status/2022951560163004923 · Twitter Post
• https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.3.16/modules/svg-image/widgets/svg-image.php#L850 · Note
• https://plugins.trac.wordpress.org/changeset/3452826/bdthemes-element-pack-lite#file1135 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/58f9bef5-6596-40b2-bcb6-d686e87d8d8f?source=cve · Note