WordPress Plugin Vulnerabilities

Elementor < 4.1.4 - Contributor+ Sensitive Data Exposure via elementor-template Shortcode

Description

The plugin is vulnerable to Sensitive Information Exposure via the `elementor-template` shortcode due to insufficient access control. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract the content of Private, Pending, and Draft Templates authored by other users.

Affects Plugins

Plugin icon
elementor
Fixed in 4.1.4

References

CVE
CVE-2026-57619
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/eb43a145-2f35-456d-bccb-671f381db1ce

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
2.7 (Low)

Miscellaneous

Original Researcher
Steven Julian
Verified
No
WPVDB ID
7ed643be-4162-4d9e-8516-713193144b5a

Timeline

Publicly Published
2026-06-25 (about 1 month ago)
Added
2026-07-02 (about 1 month ago)
Last Updated
2026-07-02 (about 1 month ago)

Other

Published
Title
Published
2024-05-07
Title
Ghost < 1.5.0 - Unauthenticated Sensitive Information Exposure
Published
2022-11-10
Title
Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure
Published
2024-04-22
Title
USPS Shipping for WooCommerce – Live Rates < 1.10.0 - Sensitive Information Exposure
Published
2025-08-18
Title
Multiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library
Published
2024-04-25
Title
User Meta < 3.1 - Unauthenticated Sensitive Information Exposure