CVE-2026-13345
Deferred Deferred - Pending Action

Unauthenticated Product Data Exposure in Essential Addons for Elementor

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: WPScan

Description
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-13345
EUVD
EUVD-2026-51012

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
essential_addons essential_addons_for_elementor to 6.6.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Essential Addons for Elementor plugin before version 6.6.10. It allows unauthenticated users to access sensitive details of non-public WooCommerce products, such as draft, pending, or private items, including their titles, prices, and SKUs.

Detection Guidance

Check if your WordPress site uses Essential Addons for Elementor plugin version prior to 6.6.10. Inspect network traffic for unauthorized requests to product-comparison endpoints that may expose draft, pending, or private WooCommerce product details.

Impact Analysis

Unauthenticated attackers could view confidential product information that should be restricted, potentially leading to data leaks, competitive disadvantages, or misuse of pricing and product details before official release.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive product data that should be restricted. Unauthorized access to private product details may result in non-compliance with privacy and security requirements.

Mitigation Strategies

Update the Essential Addons for Elementor plugin to version 6.6.10 or later immediately. If immediate update is not possible, disable the product-comparison feature or restrict access to sensitive product data until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart