Home

Description

The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_post_grid_load_more' function in all versions up to, and including, 1.3.2. This makes it possible for unauthenticated attackers to retrieve protected (draft, future, pending) post titles and excerpts that should not be accessible to unauthenticated users.

PUBLISHED Reserved 2026-02-10 | Published 2026-02-11 | Updated 2026-02-11 | Assigner Wordfence




MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status
unaffected

* (semver)
affected

Timeline

2026-02-10:Vendor Notified
2026-02-10:Disclosed

Credits

Craig Smith finder

References

www.wordfence.com/...-7c47-4fa1-af35-609c39a6cd8b?source=cve

plugins.trac.wordpress.org/...-elementor-ajax-posts-grid.php

plugins.trac.wordpress.org/...458416/wpzoom-elementor-addons

cve.org (CVE-2026-2295)

nvd.nist.gov (CVE-2026-2295)

Download JSON