Vulnerabilities / The Plus Addons for Elementor / WPSEC-2026-0270
The Plus Addons for Elementor <= 6.5.1 - Unauthenticated Information Exposure of Unapproved Comments via Post Comment Widget
Medium 5.3
CWE-200Fixed in 6.5.2
- ID
- WPSEC-2026-0270
- Plugin
- The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates (the-plus-addons-for-elementor-page-builder)
- Affected
- from 5.0.0 before 6.5.2
- Remediation
- Update to 6.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- The Plus Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in versions 5.0.0 up to, and including, 6.5.1 via the Post Comment widget. The widget passed the queried post object to get_comments() instead of query arguments, so the query fell back to its default 'all' status and the widget listed comments still held for moderation alongside approved ones. This makes it possible for unauthenticated attackers to view other visitors' unapproved comments, and to have their own held comments displayed publicly, bypassing comment moderation.
References
- https://wpsec.com/vuln/WPSEC-2026-0270/
- https://plugins.svn.wordpress.org/the-plus-addons-for-elementor-page-builder/tags/6.5.2/
- https://wordpress.org/plugins/the-plus-addons-for-elementor-page-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS