CVE-2026-8825

MEDIUM

Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API

Title source: cna

Description

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).

References (1)

Core 1

Core References

Exploit exploit vdb-entry technical-description

https://wpscan.com/vulnerability/d0d6b840-790d-45a3-9b0d-8f77a229e8a9/

Scores

CVSS v3 4.9

EPSS 0.0023

EPSS Percentile 14.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (1)

None/Elementor Website Builder < 4.1.4

Published Jul 20, 2026

Tracked Since Jul 20, 2026