The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Missing Authorization in MCP Abilities to Sensitive Information Exposure and Template Publishing
- ID
- WPSEC-2026-0268
- Plugin
- The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates (the-plus-addons-for-elementor-page-builder)
- Affected
- from 6.4.13 before 6.5.2
- Remediation
- Update to 6.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- The Plus Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The The Plus Addons for Elementor plugin for WordPress is vulnerable to unauthorized access in its MCP / Abilities API tools in versions 6.4.13 up to, and including, 6.5.1 due to missing per-post capability checks. The read abilities (get-page-structure, get-element-settings, find-element, list-pages) only checked the blanket edit_posts capability, and the save-as-template ability always created the template as 'publish' regardless of the user's publish capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the Elementor content of other users' private and draft posts, list other users' non-public pages, and publish templates into the Elementor library, on sites running a WordPress version with the Abilities API where the plugin's Abilities setting is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0268/
- https://plugins.svn.wordpress.org/the-plus-addons-for-elementor-page-builder/tags/6.5.2/
- https://wordpress.org/plugins/the-plus-addons-for-elementor-page-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS