CVE-2026-7665: CWE-639 Authorization Bypass Through User-Controlled Key in wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
The Essential Addons for Elementor – Popular Elementor Templates & Widgets WordPress plugin is vulnerable to an information exposure vulnerability in all versions up to and including 6.6.4. The vulnerability exists in the ajax_load_more function, which does not properly restrict access to posts. This allows unauthenticated attackers to access data from password protected, private, or draft posts that should normally be inaccessible.
AI Analysis
Technical Summary
CVE-2026-7665 is an information exposure vulnerability in the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress. The flaw is due to insufficient access control in the ajax_load_more function, permitting unauthorized users to retrieve content from restricted posts such as password protected, private, or draft posts. This vulnerability affects all plugin versions up to and including 6.6.4. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to extract sensitive content from posts that are intended to be restricted, including password protected, private, or draft posts. This leads to unauthorized information disclosure but does not affect integrity or availability.
Mitigation Recommendations
No official patch or remediation has been confirmed or published by the vendor as of the current information. Users should monitor the vendor's advisory for updates and apply any future patches promptly. Until a fix is available, consider restricting access to the ajax_load_more functionality or disabling the plugin if sensitive content exposure is a concern.
CVE-2026-7665: CWE-639 Authorization Bypass Through User-Controlled Key in wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets
Description
The Essential Addons for Elementor – Popular Elementor Templates & Widgets WordPress plugin is vulnerable to an information exposure vulnerability in all versions up to and including 6.6.4. The vulnerability exists in the ajax_load_more function, which does not properly restrict access to posts. This allows unauthenticated attackers to access data from password protected, private, or draft posts that should normally be inaccessible.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-7665 is an information exposure vulnerability in the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress. The flaw is due to insufficient access control in the ajax_load_more function, permitting unauthorized users to retrieve content from restricted posts such as password protected, private, or draft posts. This vulnerability affects all plugin versions up to and including 6.6.4. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to extract sensitive content from posts that are intended to be restricted, including password protected, private, or draft posts. This leads to unauthorized information disclosure but does not affect integrity or availability.
Mitigation Recommendations
No official patch or remediation has been confirmed or published by the vendor as of the current information. Users should monitor the vendor's advisory for updates and apply any future patches promptly. Until a fix is available, consider restricting access to the ajax_load_more functionality or disabling the plugin if sensitive content exposure is a concern.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-01T19:49:55.131Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a23950fe29bf47b5005f817
Added to database: 06/06/2026, 03:33:35 UTC
Last enriched: 06/13/2026, 09:56:17 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 35
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.