CVE-2026-91046

7th percentile - higher than 7% of all known CVEs

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers. Users with subscriber-level access and above can overwrite the plugin's stored settings, including stored API credentials and feature and template configuration.

Low-privilege users can modify critical settings and capture API credentials, potentially leading to further privilege escalation and site compromise.

Update the plugin to a version newer than 6.7.2 if available, and until then limit subscriber accounts and monitor changes to plugin settings.