CVE-2026-11600
Received Received - Intake

Information Disclosure in Envo's Templates & Widgets for Elementor

Publication date: 2026-07-02

Last updated on: 2026-07-02

Assigner: Wordfence

Description
The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) widget's template rendering in versions up to, and including, 1.4.26. The render() method of the Tabs widget passes a user-controlled template/post ID directly to Elementor's get_builder_content_for_display() without verifying the referenced post's status (published/private/draft) or the visitor's authorization to view it. This makes it possible for authenticated attackers, with Author-level access and above, to disclose the contents of private Elementor-driven pages and templates to anonymous visitors by configuring an Envo Tabs widget on a public post to reference the private content's ID (which can be supplied by editing the underlying Elementor widget JSON via the Elementor editor REST API).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-02
Last Modified
2026-07-02
Generated
2026-07-02
AI Q&A
2026-07-02
EPSS Evaluated
N/A
NVD
CVE-2026-11600
EUVD
EUVD-2026-41244

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
envo templates_and_widgets_for_elementor_and_woocommerce to 1.4.26 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress, specifically in versions up to and including 1.4.26. It is caused by a missing authorization check in the Envo Tabs (and Off Canvas) widget's template rendering process.

The render() method of the Tabs widget takes a user-controlled template or post ID and passes it directly to Elementor's get_builder_content_for_display() function without verifying whether the referenced post is published, private, or draft, or whether the visitor is authorized to view it.

As a result, authenticated attackers with Author-level access or higher can disclose the contents of private Elementor-driven pages and templates to anonymous visitors by configuring an Envo Tabs widget on a public post to reference the private content's ID. This ID can be supplied by editing the underlying Elementor widget JSON via the Elementor editor REST API.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of private content on a WordPress site using the affected plugin. Attackers with Author-level access or higher can expose private Elementor-driven pages and templates to anyone, including anonymous visitors.

This means sensitive or confidential information intended to be restricted could be publicly revealed, potentially damaging the site's confidentiality and trustworthiness.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart