CVE-2026-91047

11th percentile - higher than 11% of all known CVEs

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads. Unauthenticated users can bypass the payment requirement and retrieve any product's paid downloadable file.

This allows unauthorized access to paid digital content, leading to financial loss and undermining the store's business model. It may also result in leakage of proprietary materials.

Update the ElementsReady Addons for Elementor plugin to a version newer than 6.7.2 if available, or implement additional access controls for downloadable files.