Executive brief
Elementor is a popular website building tool for WordPress. A security flaw in this plugin allows users with low-level 'Contributor' accounts to view private posts, drafts, and pages created by other users, including administrators. This could lead to the exposure of sensitive internal information or unpublished content before it is ready for the public.
Technical details
An information disclosure vulnerability exists in the Elementor Website Builder plugin for WordPress due to improper authorization checks in its REST API. Specifically, the `elementor/v1/post` endpoint fails to validate if the requesting user has the necessary permissions to view non-public content. An authenticated attacker with at least Contributor-level privileges can bypass standard WordPress REST API restrictions by supplying specific parameters (such as `is_public=false` and a custom `keys_conversion_map`) to the Elementor endpoint. This allows the attacker to retrieve the title, content, and metadata of private posts, pages, and drafts authored by any user. The issue is fixed in version 4.1.4.
Affected products
- Elementor Elementor Website Builder < 4.1.4
Timeline
- 2026-06-29: disclosed: Publicly published by WPScan
- 2026-07-20: advisory: NVD published date