CVE-2026-2916
Received Received - Intake

Jeg Kit for Elementor Sensitive Information Exposure

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-2916
EUVD
EUVD-2026-51740

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jeg_plugins jeg_kit_for_elementor to 3.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Sensitive Information Exposure flaw in the Jeg Kit for Elementor WordPress plugin. It allows authenticated users with Contributor-level access or higher to view sensitive site configuration data, plugin details, system environment information, and potentially third-party API keys through an exposed JavaScript object injected on the admin page.

Detection Guidance

Check if the Jeg Kit for Elementor plugin version 3.1.1 or below is installed. Inspect the post.php admin page source for the injected JkitDashboardOption JavaScript object containing plugin inventory, system details, or API credentials.

Impact Analysis

An attacker with Contributor-level access could extract sensitive data like WordPress and PHP versions, installed plugins, server capabilities, site URLs, and API keys. This information could be used for further attacks, such as exploiting other vulnerabilities or gaining unauthorized access to third-party services.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing sensitive personal or health-related data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized access to such data violates these regulations.

Mitigation Strategies

Update the Jeg Kit for Elementor plugin to the latest version beyond 3.1.1. If an update is unavailable, consider disabling or removing the plugin immediately to prevent exposure of sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2916. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart