CVE-2026-7665

Deferred Deferred - Pending Action

Information Exposure in Essential Addons for Elementor Plugin

Publication date: 2026-06-06

Last updated on: 2026-06-08

Assigner: Wordfence

Description

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-06

Last Modified

2026-06-08

Generated

2026-07-17

AI Q&A

2026-06-06

EPSS Evaluated

2026-07-15

NVD

CVE-2026-7665

EUVD

EUVD-2026-34950

Affected Vendors & Products

Vendor	Product	Version / Range
essential_addons	essential_addons_for_elementor	to 6.6.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

The Essential Addons for Elementor plugin for WordPress has a vulnerability in its ajax_load_more function in all versions up to and including 6.6.4. This vulnerability arises because there are insufficient restrictions on which posts can be included when loading content via AJAX.

As a result, unauthenticated attackers can exploit this flaw to access data from posts that are password protected, private, or in draft status, which they should normally not be able to view.

Impact Analysis

This vulnerability can lead to unauthorized information disclosure. Attackers without any authentication can extract sensitive or private content from your WordPress site, including password protected, private, or draft posts.

Such exposure can compromise the confidentiality of your data and potentially harm your site's reputation or trustworthiness.

Compliance Impact

This vulnerability allows unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

Such unauthorized data exposure could potentially lead to non-compliance with data protection regulations like GDPR or HIPAA, which require strict controls over access to sensitive or personal information.

However, the provided information does not explicitly mention the impact on compliance with these standards.

Hi! I’m here to help you understand CVE-2026-7665. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70