CVE-2026-11905
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Elementor Website Builder plugin for WordPress in all versions up to and including 4.2.3 is vulnerable to Sensitive Information Exposure via the 'keys_conversion_map' parameter. An authenticated attacker with contributor-level access or above can extract the full post_content and plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors.
Risk Assessment
A low-privileged attacker can access confidential content and passwords of protected posts, leading to data leakage and possible escalation of access to editorial content.
Recommendation
Update the Elementor Website Builder plugin to a version later than 4.2.3, or if not possible, limit the number of accounts with contributor-level access and above.
Other vulnerabilities in Elementor Website Builder
See all- CVE-2026-57619Medium
The Elementor Website Builder plugin version 4.1.3 and earlier contains a contributor sensitive data exposure vulnerability. This flaw may allow an attacker to access confidential information stored by the plugin.
- CVE-2026-62062High
The Elementor Website Builder plugin is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects versions from n/a through 4.3.1.
- CVE-2026-8825Medium
The Elementor Website Builder WordPress plugin before version 4.1.4 fails to properly check user permissions before returning post data via one of its REST endpoints. This allows authenticated users with Contributor-level access and above to retrieve the title, body, and metadata of private posts, private pages, and drafts authored by other users (including administrators).
- CVE-2026-49782Medium
Missing authorization in the Elementor Website Builder plugin for WordPress (versions up to 4.1.0) allows exploiting incorrectly configured access control security levels.
- CVE-2025-67588Medium
The Elementor Website Builder plugin for WordPress in versions up to and including 3.33.0 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full post_content and plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS