CVE-2026-103907: CWE-862 Missing Authorization in jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

CVE-2026-103907 describes a missing authorization vulnerability (CWE-862) in the JNews - Jeg Elementor Kit plugin for WordPress, affecting versions up to and including 3.2.19. The vulnerability arises because the AJAX handlers 'wp_ajax_jkit_post_block' and 'wp_ajax_jeg_find_author' lack proper capability checks. The 'jkit_post_block' handler returns the element's full option schema, including a nonce for 'jeg_find_author', to any authenticated user. The 'jeg_find_author' handler executes a WP_User_Query using attacker-supplied input to search user_email and other fields, echoing matching user IDs and display names. This allows authenticated attackers with minimal privileges to enumerate all registered users and reconstruct email addresses character-by-character via substring search.

An attacker with Subscriber-level or higher access can enumerate all registered users on the WordPress site and infer their email addresses. This compromises user privacy and could facilitate targeted phishing or social engineering attacks. There is no indication of privilege escalation or direct system compromise, but the confidentiality of user data is impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for suspicious activity. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor updates closely for an official fix.