CVE-2026-115949
MediumCVSS 6.5Summary
The Better Post & Filter Widgets for Elementor plugin (up to version 1.9.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthenticated users to perform actions they should not have access to.
Risk Assessment
An attacker could exploit this flaw to gain unauthorized access to plugin functionality, potentially leading to content modification or data disclosure. The risk affects websites running the vulnerable plugin version.
Recommendation
Update the Better Post & Filter Widgets for Elementor plugin to the latest version (above 1.9.1). If updating is not possible, consider disabling the plugin until a fix is available.
Other vulnerabilities in Better Post & Filter Widgets for Elementor
See all- CVE-2026-115950Medium
The Better Post & Filter Widgets for Elementor plugin through version 1.9.1 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.
- CVE-2025-48354Medium
The Better Post & Filter Widgets for Elementor plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Better Post & Filter Widgets for Elementor versions from n/a through 1.6.1.
Original NVD description (English source)
Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS