Description
The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.
Problem types
CWE-639 Authorization Bypass Through User-Controlled Key
Product status
Any version
Timeline
| 2026-01-19: | Vendor Notified |
| 2026-03-25: | Disclosed |
Credits
Angus Girvan
References
www.wordfence.com/...-4952-4460-afc2-1c6df6965b3d?source=cve
plugins.trac.wordpress.org/...-library%2Fsources%2Flocal.php