CVE-2026-91046
Received Received - Intake

Authorization Bypass in ElementsReady Addons for Elementor

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: WPScan

Description
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-91046
EUVD
EUVD-2026-104084

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown ElementsReady Addons for Elementor 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The ElementsReady Addons for Elementor WordPress plugin through version 6.7.2 has a vulnerability where it fails to perform proper authorization checks. This allows users with subscriber-level access or higher to overwrite the plugin's stored settings, including API credentials and configuration settings.

Detection Guidance

Check if the ElementsReady Addons for Elementor plugin version is 6.7.2 or lower. Inspect WordPress user roles with subscriber access or higher for unauthorized settings modifications.

Impact Analysis

An attacker with subscriber-level access could modify plugin settings, steal API credentials, or change feature and template configurations. This could lead to unauthorized access, data breaches, or disruption of the WordPress site's functionality.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, potentially violating GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations may face compliance penalties if sensitive data is compromised due to this issue.

Mitigation Strategies

Update the ElementsReady Addons for Elementor plugin to the latest version beyond 6.7.2. Review and restrict user roles with subscriber-level access or higher to prevent unauthorized settings changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart