Executive brief
The Jeg Kit for Elementor plugin for WordPress, which provides additional design widgets and templates, contains a security flaw that exposes sensitive site information. An authenticated user with basic 'Contributor' permissions can view internal system details, a full list of installed plugins, and potentially third-party API keys like Mailchimp. This information could be used by an attacker to plan more advanced attacks or gain unauthorized access to connected third-party services.
Technical details
The vulnerability is classified as Sensitive Information Exposure (CWE-200) within the `enqueue_scripts()` method of `class/dashboard/class-dashboard.php`. The plugin injects a JavaScript object named `JkitDashboardOption` as an inline script on the `post.php` admin page without performing adequate capability checks. This object contains a full plugin inventory, system environment details (PHP/WordPress versions, server capabilities), and potentially third-party API credentials such as Mailchimp keys. An attacker with at least Contributor-level authentication can view this data by inspecting the page source. The issue is addressed in version 3.1.2.
Affected products
- Jegtheme Jeg Kit for Elementor <= 3.1.1
Timeline
- 2026-08-01: advisory: NVD publication date
- 2026-08-01: disclosed: Wordfence disclosure date
References
- https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php
- https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php
- https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fjeg-elementor-kit/tags/3.1.1&new_path=%2Fjeg-elementor-kit/tags/3.1.2
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a420a8b5-e43e-4c0d-86f3-b35f11efdf46?source=cve