# CVE-2026-7665: WPDeveloper Essential Addons for Elementor information exposure in ajax_load_more

Source: https://junglewise.ai/threats/cve-2026-7665-wpdeveloper-essential-addons-for-elementor-information-exposure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-06. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2026-7665 · Severity: medium · CVSS 5.3 · Published 2026-06-06

A popular WordPress plugin used for website design is vulnerable to a flaw that allows unauthorized users to view restricted content. This means an attacker could potentially read private drafts, password-protected posts, or other hidden site content without needing a login. This could lead to the exposure of sensitive business information or upcoming site updates before they are intended for public release.

Technologies: [WPDeveloper Essential Addons for Elementor – Popular Elementor Templates & Widgets](https://junglewise.ai/threats/technologies/essential-addons-for-elementor-lite). Vendors: [WPDeveloper](https://junglewise.ai/threats/vendors/wpdeveloper).

## Quick answers

**Is CVE-2026-7665 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7665 being exploited in the wild.

**How severe is CVE-2026-7665?** Medium severity, with a CVSS score of 5.3, published 6 June 2026.

**Which products and versions are affected?** WPDeveloper Essential Addons for Elementor – Popular Elementor Templates & Widgets up to, and including, 6.6.4.

**Is there a fix for CVE-2026-7665?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7665 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7665?** Check whether you run WPDeveloper Essential Addons for Elementor – Popular Elementor Templates & Widgets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as Information Exposure (CWE-639) within the 'ajax_load_more' function of the Essential Addons for Elementor plugin. The root cause is insufficient restrictions on post status and visibility during AJAX-based content loading. An unauthenticated remote attacker can exploit this by sending crafted requests to the AJAX handler to retrieve content from posts that are otherwise restricted, such as those in 'draft' or 'private' status, or those protected by a password. This bypasses standard WordPress authorization checks for post visibility. The issue affects all versions up to and including 6.6.4.

## Affected products

- WPDeveloper Essential Addons for Elementor – Popular Elementor Templates & Widgets up to, and including, 6.6.4

## Timeline

- 2026-06-06: disclosed
- 2026-06-06: advisory

## References

- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.13/includes/Traits/Ajax_Handler.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.3/includes/Traits/Ajax_Handler.php)