CVE-2026-8825
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Elementor Website Builder WordPress plugin before version 4.1.4 fails to properly check user permissions before returning post data via one of its REST endpoints. This allows authenticated users with Contributor-level access and above to retrieve the title, body, and metadata of private posts, private pages, and drafts authored by other users (including administrators).
Risk Assessment
The organization is at risk of leaking confidential content such as unpublished projects, private pages, or administrator drafts, potentially exposing sensitive business information or plans.
Recommendation
Immediately update the Elementor Website Builder plugin to version 4.1.4 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Elementor Website Builder
See all- CVE-2026-57619Medium
The Elementor Website Builder plugin version 4.1.3 and earlier contains a contributor sensitive data exposure vulnerability. This flaw may allow an attacker to access confidential information stored by the plugin.
- CVE-2026-49782Medium
Missing authorization in the Elementor Website Builder plugin for WordPress (versions up to 4.1.0) allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).