Executive brief
Essential Addons for Elementor is a popular WordPress plugin used to add extra design elements to websites. A security flaw in its product-comparison feature allows anyone on the internet to view details of WooCommerce products that are supposed to be hidden, such as draft, pending, or private items. This could lead to the exposure of upcoming product names, pricing strategies, and internal stock-keeping units (SKUs) before a business is ready to launch them.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) within the 'eael_product_grid' AJAX action. The plugin's product-comparison logic resolves WooCommerce products via 'wc_get_product()' without verifying the 'post_status' or 'visibility' of the requested IDs. An unauthenticated attacker can obtain a public nonce from the page source and then send a crafted AJAX request to 'admin-ajax.php' to retrieve the title, price, and SKU of products that are otherwise restricted (e.g., draft, pending, or private). This issue represents an incomplete fix for previous disclosure vulnerabilities where other handlers were patched but the comparison path remained exposed. The issue is resolved in version 6.6.10.
Affected products
- WPDeveloper Essential Addons for Elementor < 6.6.10
Timeline
- 2026-07-13: disclosed: Initial public disclosure by researcher
- 2026-07-13: patched: Vendor released version 6.6.10 to address the issue
- 2026-07-30: advisory: NVD publication date