5.3
MediumCVSS 3.1 · from CISA
CVE-2026-110509
Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler
Essential Addons for Elementor · Information exposure · CWE-200AffectedEssential Addons for Elementor
FixUpdate to 6.8.7 or newer
PublishedOct 28, 06:00 · WPScan
Scored5.3 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.
From WPScan
Affected and fixed versions
ProductAffectedFixed inEssential Addons for Elementorbefore 6.8.76.8.7
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known