CVE-2026-49782
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Missing authorization in the Elementor Website Builder plugin for WordPress (versions up to 4.1.0) allows exploiting incorrectly configured access control security levels.
Risk Assessment
An attacker may gain unauthorized access to administrative functions or data, leading to privilege escalation.
Recommendation
Update the Elementor Website Builder plugin to the latest available version.
Other vulnerabilities in Elementor Website Builder
See all- CVE-2026-57619Medium
The Elementor Website Builder plugin version 4.1.3 and earlier contains a contributor sensitive data exposure vulnerability. This flaw may allow an attacker to access confidential information stored by the plugin.
- CVE-2026-8825Medium
The Elementor Website Builder WordPress plugin before version 4.1.4 fails to properly check user permissions before returning post data via one of its REST endpoints. This allows authenticated users with Contributor-level access and above to retrieve the title, body, and metadata of private posts, private pages, and drafts authored by other users (including administrators).
Original NVD description (English source)
Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elementor Website Builder: from n/a through 4.1.0.