CVE-2026-103907

Deferred Deferred - Pending Action

Information Disclosure in JNews Jeg Elementor Kit

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Wordfence

Description

The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element's full option schema — including a freshly minted wp_create_nonce('jeg_find_author') — to any authenticated caller, and the 'wp_ajax_jeg_find_author' handler then runs a WP_User_Query with the attacker-supplied 'query' wrapped in '*…*' against search_columns that include user_email, echoing the ID and display_name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103907

EUVD

EUVD-2026-100909

Affected Vendors & Products

Vendor	Product	Version / Range
jegtheme	Jeg	Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The JNews - Jeg Elementor Kit WordPress plugin has a vulnerability due to missing capability checks in two AJAX actions: 'jkit_post_block' and 'jeg_find_author'. These actions allow authenticated users with Subscriber-level access or higher to access sensitive data. The 'jkit_post_block' action exposes the plugin's full option schema, including a nonce, to any authenticated caller. The 'jeg_find_author' action performs a user query that can be manipulated to enumerate all registered users and reconstruct email addresses by exploiting substring searches.

Detection Guidance

To detect this vulnerability, check WordPress sites using the JNews - Jeg Elementor Kit plugin versions up to 3.2.19. Look for unauthorized user enumeration attempts via AJAX calls to 'jkit_post_block' or 'jeg_find_author' endpoints. Monitor logs for suspicious Subscriber-level access attempts or unusual queries against user data.

Impact Analysis

If you use the JNews - Jeg Elementor Kit plugin in versions up to 3.2.19, attackers with basic user access could steal sensitive user data. They can list all registered users and guess email addresses character by character. This exposes personal information and could lead to further attacks like phishing or identity theft.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal data without authorization. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A breach could result in legal penalties, fines, and reputational damage due to non-compliance with data protection regulations.

Mitigation Strategies

Update the JNews - Jeg Elementor Kit plugin to the latest version, which should address the missing capability checks. If an update is not available, consider disabling the plugin temporarily until a patch is released.

Hi! I’m here to help you understand CVE-2026-103907. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70