The vulnerability originates from missing capability checks on the ‘jkit_post_block’ and ‘jeg_find_author’ AJAX actions in Jeg Kit for Elementor versions up to 3.2.19. An authenticated user with Subscriber or higher permissions can trigger these actions to retrieve the entire option schema for elements and to issue user queries that return the ID and display name of any user matching a supplied substring. This allows an attacker to enumerate all site users and reconstruct their email addresses character by character. The weakness corresponds to CWE‑862, Absent Authorization.

Vendors: jegtheme. Product: Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress. Affected versions: all releases up to and including 3.2.19. Users must be running WordPress with this plugin installed.

The CVSS score of 6.5 indicates a moderate impact. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. However, any authenticated site user who has Subscriber‑level access—often a common role—can exploit the flaw by invoking the AJAX endpoints. Because the data exposed is sensitive user information and the attacker can reconstruct complete email addresses, the risk to confidentiality is high. Since the attack requires authenticated access, a compromised or malicious user could systematically enumerate the entire user base. The lack of recent exploitation reports combined with the low EPSS means that immediate patching is still recommended, but the overall threat is considered moderate compared to high‑severity exploits.