# CVE-2026-2916: Jegtheme Jeg Kit for Elementor sensitive information exposure

Source: https://junglewise.ai/threats/cve-2026-2916-jegtheme-jeg-kit-for-elementor-sensitive-information-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-01  
License: CC BY 4.0 with a link back

CVE-2026-2916 · Severity: medium · CVSS 4.3 · Published 2026-08-01

The Jeg Kit for Elementor plugin for WordPress, which provides additional design widgets and templates, contains a security flaw that exposes sensitive site information. An authenticated user with basic 'Contributor' permissions can view internal system details, a full list of installed plugins, and potentially third-party API keys like Mailchimp. This information could be used by an attacker to plan more advanced attacks or gain unauthorized access to connected third-party services.

Technologies: [Jegtheme Jeg Kit for Elementor](https://junglewise.ai/threats/technologies/jeg-elementor-kit). Vendors: [Jegtheme](https://junglewise.ai/threats/vendors/jegtheme).

## Quick answers

**Is CVE-2026-2916 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2916 being exploited in the wild.

**How severe is CVE-2026-2916?** Medium severity, with a CVSS score of 4.3, published 1 August 2026.

**Which products and versions are affected?** Jegtheme Jeg Kit for Elementor <= 3.1.1.

**Is there a fix for CVE-2026-2916?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-2916 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2916?** Check whether you run Jegtheme Jeg Kit for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as Sensitive Information Exposure (CWE-200) within the `enqueue_scripts()` method of `class/dashboard/class-dashboard.php`. The plugin injects a JavaScript object named `JkitDashboardOption` as an inline script on the `post.php` admin page without performing adequate capability checks. This object contains a full plugin inventory, system environment details (PHP/WordPress versions, server capabilities), and potentially third-party API credentials such as Mailchimp keys. An attacker with at least Contributor-level authentication can view this data by inspecting the page source. The issue is addressed in version 3.1.2.

## Affected products

- Jegtheme Jeg Kit for Elementor <= 3.1.1

## Timeline

- 2026-08-01: advisory: NVD publication date
- 2026-08-01: disclosed: Wordfence disclosure date

## References

- [https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php](https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php)
- [https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php](https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php)
- [https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php](https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.0.3/class/dashboard/class-dashboard.php)
- [https://plugins.trac.wordpress.org/changeset?old_path=%2Fjeg-elementor-kit/tags/3.1.1&new_path=%2Fjeg-elementor-kit/tags/3.1.2](https://plugins.trac.wordpress.org/changeset?old_path=%2Fjeg-elementor-kit/tags/3.1.1&new_path=%2Fjeg-elementor-kit/tags/3.1.2)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/a420a8b5-e43e-4c0d-86f3-b35f11efdf46?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/a420a8b5-e43e-4c0d-86f3-b35f11efdf46?source=cve)