Description
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Published: 2026-06-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The perk of the vulnerability lies in an insecure AJAX handler that can return posts regardless of their status. The missing authorization check makes it possible for anyone to retrieve data from password‑protected, private or draft posts that they should not have access to. As a result, the confidentiality of posts uploaded through the plugin is compromised without requiring any user credentials. The weakness is mapped to CWE‑639: Authorization Bypass Through Privileged Clear-Text Log.

Affected Systems

This vulnerability affects the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress provided by wpdevteam. All released versions up to and including 6.6.4 are impacted, including the 6.5.x and 6.6.x branches referenced in the vendor release notes.

Risk and Exploitability

The CVSS score for the issue is 5.3, indicating a medium impact level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be unauthenticated access to the "load_more" AJAX endpoint. Any visitor to the site can trigger the action and receive sensitive post content, making the risk moderate for sites that store sensitive information and have the plugin installed.

Generated by OpenCVE AI on June 6, 2026 at 04:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Essential Addons for Elementor plugin to the latest available version that removes the missing authorization check on the AJAX handler.
  • If an immediate patch cannot be applied, block unauthenticated access to the "load_more" AJAX action using a security plugin or custom code that checks user capability before executing the handler.
  • If the plugin cannot be temporarily secured, consider deactivating or uninstalling it until a patched version is released.

Generated by OpenCVE AI on June 6, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php#L106 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php#L1601 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php#L197 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php#L292 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php#L106 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php#L1601 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php#L197 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php#L292 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L106 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L1601 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L197 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L292 cve-icon cve-icon
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3541534%40essential-addons-for-elementor-lite&new=3541534%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail= cve-icon cve-icon
https://www.wordfence.com/threat-intel/vulnerabilities/id/861ece65-bee7-4124-b1a8-de9fb0c1cbc7?source=cve cve-icon cve-icon
History

Sat, 06 Jun 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 06 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpdevteam
Wpdevteam essential Addons For Elementor – Popular Elementor Templates & Widgets
Vendors & Products Wordpress
Wordpress wordpress
Wpdevteam
Wpdevteam essential Addons For Elementor – Popular Elementor Templates & Widgets

Sat, 06 Jun 2026 03:30:00 +0000

Type Values Removed Values Added
Description The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Title Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Wordpress Wordpress
Wpdevteam Essential Addons For Elementor – Popular Elementor Templates & Widgets
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-06-06T11:47:54.832Z

Reserved: 2026-05-01T19:49:55.131Z

Link: CVE-2026-7665

cve-icon Vulnrichment

Updated: 2026-06-06T11:47:49.778Z

cve-icon NVD

Status : Received

Published: 2026-06-06T04:17:40.400

Modified: 2026-06-06T04:17:40.400

Link: CVE-2026-7665

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-06T04:30:12Z

Weaknesses