CVE-2026-4362
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function in all versi…
Published May 5, 2026 · updated Jun 17, 2026
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress action and triggers when both and GET parameters are present, with no authentication or nonce verification. This makes it possible for unauthenticated attackers to overwrite the Elementor content ( ) of any custom post type by visiting a specially crafted URL. The widget's custom designs, text, and configurations are permanently replaced with a blank template.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 5, 2026 · NIST NVD
Detected
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress action and triggers when both and GET parameters are present, with no authentication or nonce verification. This makes it possible for unauthenticated attackers
Jun 17, 2026 · NIST NVD
Updated
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress action and triggers when both and GET parameters are present, with no authentication or nonce verification. This makes it possible for unauthenticated attackers
Sources
- CVE.orgVulnerability recordCVE-2026-4362
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-4362
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress action and
nvd.nist.gov