CVE-2026-2916 describes a sensitive information exposure vulnerability in the Jeg Kit for Elementor plugin for WordPress. The vulnerability occurs in the enqueue_scripts() method of class-dashboard.php, where a JavaScript object named JkitDashboardOption is injected into the post.php admin page. This object contains detailed plugin inventory (names, versions, paths, active status), system environment information (WordPress and PHP versions, site URLs, server capabilities), and potentially sensitive third-party API credentials such as a Mailchimp API key. Because the plugin does not enforce sufficient capability checks beyond requiring post editing permissions, any authenticated user with Contributor-level access or above can access this sensitive data by viewing the page source, potentially leading to unauthorized disclosure of site configuration and credentials.

The vulnerability allows authenticated users with Contributor-level or higher privileges to access sensitive configuration data, including installed plugin details and potentially third-party API keys. This exposure could facilitate further attacks or unauthorized access if the leaked information is leveraged by attackers. However, the vulnerability does not allow privilege escalation or denial of service directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for updates from the vendor. Avoid exposing sensitive API keys in plugin configurations accessible to lower-privileged users.