CVE-2026-1004

Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure

Published Jan 16, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.

Analysis

Technical impact

The Essential Addons for Elementor plugin for WordPress suffers from a missing authorization flaw in the eael_product_quickview_popup routine. Unauthenticated callers can invoke this routine to retrieve WooCommerce product data for items that are in draft, pending, or private state, which should otherwise be hidden from public view. This vulnerability discloses confidential product details and constitutes a confidentiality breach, as classified under CWE‑862.

Affected Systems

WordPress sites running the Essential Addons for Elementor plugin from the wpdevteam under the name "Essential Addons for Elementor – Popular Elementor Templates & Widgets". Versions through and including 6.5.5 are affected.

Risk and Exploitability

The CVSS v3.1 score of 5.3 places the issue in the moderate range, while the EPSS score of less than 1% indicates a very low probability of exploitation in the general population. The vulnerability does not require any privileged state and can be triggered by unauthenticated HTTP requests to the plugin’s Ajax interface, likely via the eael_product_quickview_popup endpoint. Attackers could mass‑query product details on any site that has the plugin installed and exposed, thereby leaking private product information.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

wpdevteam

Essential Addons for Elementor – Popular Elementor Templates & Widgets

unaffected

Version	Status	Constraints
`0`	affected	≤ 6.5.5

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—
Wpdevteam	Essential Addons For Elementor	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Essential Addons for Elementor plugin to the latest available version, ensuring any version after 6.5.5 that contains the fix is applied.
If a plugin update is delayed, block unauthenticated access to the eael_product_quickview_popup Ajax endpoint by adding a rule in your web server configuration or using a security plugin to restrict that URL to authenticated users only.
Modify the plugin's Ajax handler (files such as includes/Traits/Ajax_Handler.php) to check for a proper capability (e.g., 'read_product') before returning any product data, so that only users with explicit permission can view draft, pending, or private products.

Generated by OpenCVE AI on April 16, 2026 at 07:56 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.374% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/WPDevelopers/essential-addons-for-elementor-lite/commit/4e43db06bcf12870cc3b185ed59b3fe2cd227945
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L1439
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L64
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L65
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L820
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L832
https://www.wordfence.com/threat-intel/vulnerabilities/id/06ef9a21-e2b9-40c7-9de5-cff175fa10a5?source=cve

History

Jan 16, 2026 2:15 PM First appearance in the feed. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress Wpdevteam Wpdevteam essential Addons For Elementor
Vendors & Products		Wordpress Wordpress wordpress Wpdevteam Wpdevteam essential Addons For Elementor
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 16, 2026 8:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.
Title		Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Weaknesses		CWE-862
References		https://github.com/WPDevelopers/essential-addons-for-elementor-lite/commit/4e43db06bcf12870cc3b185ed59b3fe2cd227945 https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L1439 https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L64 https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L65 https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L820 https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L832 https://www.wordfence.com/threat-intel/vulnerabilities/id/06ef9a21-e2b9-40c7-9de5-cff175fa10a5?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`