CVE-2026-7665

Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler

View on CVE.org
Published Jun 6, 2026 CVSS 3.1 · 5.3 Medium EPSS 6.8% KEV · Not listed
Description
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

Analysis

AI-generated

Technical impact

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to. The flaw is a CWE‑639 Authorization Bypass Through User‑Controlled Input vulnerability; consequently, attackers can request content that is normally inaccessible, leading to the unauthorized disclosure of confidential site content.

Affected Systems

The flaw affects the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress. All releases up to and including version 6.6.4 are vulnerable, covering the 6.5.x and 6.6.x branches referenced in the vendor release notes.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability falls into the medium category. The EPSS score of 7% indicates a higher likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is likely unauthenticated for any visitor that can access the "load_more" endpoint; no specific user authentication or privilege is required to trigger the data leak.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Essential Addons for Elementor plugin to any version that removes the missing authorization check on the AJAX handler.
  • , block unauthenticated access to the "load_more" AJAX action using a security plugin, custom code, or firewall rule that verifies user capabilities before executing the handler.
  • If the plugin must remain online but cannot be secured quickly, consider deactivating or uninstalling it until a patched version is released.

Generated by OpenCVE AI on October 25, 2026 at 19:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References
Link Providers
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php#L106 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php#L1601 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php#L197 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php#L292 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php#L106 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php#L1601 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php#L197 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php#L292 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L106 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L1601 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L197 cve-icon cve-icon
https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L292 cve-icon cve-icon
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3541534%40essential-addons-for-elementor-lite&new=3541534%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail= cve-icon cve-icon
https://www.wordfence.com/threat-intel/vulnerabilities/id/861ece65-bee7-4124-b1a8-de9fb0c1cbc7?source=cve cve-icon cve-icon
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpdevteam
Wpdevteam essential Addons For Elementor – Popular Elementor Templates & Widgets
Vendors & Products Wordpress
Wordpress wordpress
Wpdevteam
Wpdevteam essential Addons For Elementor – Popular Elementor Templates & Widgets
Type Values Removed Values Added
Description The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Title Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Jun 6, 2026, 11:47 AM
Reserved
May 1, 2026, 7:49 PM

View source JSON

Updated
Jun 6, 2026, 11:47 AM

JSON

Status
Deferred
Published
Jun 6, 2026, 4:17 AM
Modified
Jul 23, 2026, 7:10 AM

View source JSON

No data.

Updated
Oct 25, 2026, 7:45 PM

JSON