CVE-2026-2916 describes a sensitive information exposure vulnerability in the Jeg Kit for Elementor plugin for WordPress. The vulnerability exists in the enqueue_scripts() method of class-dashboard.php, which injects a JavaScript object (JkitDashboardOption) containing detailed plugin and system information, including potentially sensitive third-party API keys, into the post.php admin page. Because the plugin does not enforce proper capability checks beyond requiring post editing access, any authenticated user with Contributor-level permissions or above can access this data by viewing the page source, leading to unauthorized disclosure of sensitive configuration details.

Authenticated users with Contributor-level access or higher can obtain sensitive site configuration data, including installed plugin details, system environment information, and potentially third-party API credentials such as Mailchimp API keys. This exposure could facilitate further attacks or misuse of the disclosed credentials. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access carefully and monitor for updates from the vendor. Avoid granting Contributor or higher privileges to untrusted users.