Junglewise Threat Intelligence

CVE-2026-7665: WPDeveloper Essential Addons for Elementor information exposure in ajax_load_more

CVE-2026-7665 · Severity: medium · CVSS 5.3 · Published 2026-06-06

Technologies: WPDeveloper Essential Addons for Elementor – Popular Elementor Templates & Widgets. Vendors: WPDeveloper.

Executive brief

A popular WordPress plugin used for website design is vulnerable to a flaw that allows unauthorized users to view restricted content. This means an attacker could potentially read private drafts, password-protected posts, or other hidden site content without needing a login. This could lead to the exposure of sensitive business information or upcoming site updates before they are intended for public release.

Technical details

The vulnerability is classified as Information Exposure (CWE-639) within the 'ajax_load_more' function of the Essential Addons for Elementor plugin. The root cause is insufficient restrictions on post status and visibility during AJAX-based content loading. An unauthenticated remote attacker can exploit this by sending crafted requests to the AJAX handler to retrieve content from posts that are otherwise restricted, such as those in 'draft' or 'private' status, or those protected by a password. This bypasses standard WordPress authorization checks for post visibility. The issue affects all versions up to and including 6.6.4.

Affected products

  • WPDeveloper Essential Addons for Elementor – Popular Elementor Templates & Widgets up to, and including, 6.6.4

Timeline

  • 2026-06-06: disclosed
  • 2026-06-06: advisory

References