Description
The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.
Published: 2026-01-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Exposure
Action: Apply Patch
AI Analysis

Impact

The Essential Addons for Elementor plugin for WordPress suffers from a missing authorization flaw in the eael_product_quickview_popup routine. Unauthenticated callers can invoke this routine to retrieve WooCommerce product data for items that are in draft, pending, or private state, which should otherwise be hidden from public view. This vulnerability discloses confidential product details and constitutes a confidentiality breach, as classified under CWE‑862.

Affected Systems

WordPress sites running the Essential Addons for Elementor plugin from the wpdevteam under the name "Essential Addons for Elementor – Popular Elementor Templates & Widgets". Versions through and including 6.5.5 are affected.

Risk and Exploitability

The CVSS v3.1 score of 5.3 places the issue in the moderate range, while the EPSS score of less than 1% indicates a very low probability of exploitation in the general population. The vulnerability does not require any privileged state and can be triggered by unauthenticated HTTP requests to the plugin’s Ajax interface, likely via the eael_product_quickview_popup endpoint. Attackers could mass‑query product details on any site that has the plugin installed and exposed, thereby leaking private product information.

Generated by OpenCVE AI on April 16, 2026 at 07:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Essential Addons for Elementor plugin to the latest available version, ensuring any version after 6.5.5 that contains the fix is applied.
  • If a plugin update is delayed, block unauthenticated access to the eael_product_quickview_popup Ajax endpoint by adding a rule in your web server configuration or using a security plugin to restrict that URL to authenticated users only.
  • Modify the plugin's Ajax handler (files such as includes/Traits/Ajax_Handler.php) to check for a proper capability (e.g., 'read_product') before returning any product data, so that only users with explicit permission can view draft, pending, or private products.

Generated by OpenCVE AI on April 16, 2026 at 07:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Jan 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpdevteam
Wpdevteam essential Addons For Elementor
Vendors & Products Wordpress
Wordpress wordpress
Wpdevteam
Wpdevteam essential Addons For Elementor
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Jan 2026 08:30:00 +0000

Type Values Removed Values Added
Description The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.
Title Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Wordpress Wordpress
Wpdevteam Essential Addons For Elementor
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:33:51.372Z

Reserved: 2026-01-15T20:03:46.612Z

Link: CVE-2026-1004

cve-icon Vulnrichment

Updated: 2026-01-16T13:44:30.809Z

cve-icon NVD

Status : Deferred

Published: 2026-01-16T09:16:21.407

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-1004

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T08:00:11Z

Weaknesses