CVE-2026-8825— Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Elementor Website Builder | < 4.1.4 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-8825
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API
Source: CVE Program / CVE List V5
Vulnerability Description
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Elementor Website Builder 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
elemntor Elementor Website Builder – more than just a page builder是elemntor的CMS插件。 Elementor Website Builder 4.1.4之前版本存在信息泄露漏洞，该漏洞源于未正确检查用户权限，允许拥有贡献者级别及以上访问权限的认证用户检索其他用户（包括管理员）创建的私密文章、私密页面和草稿的标题、正文和元数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Elementor Website Builder | 0 ~ 4.1.4 | - |
II. Public POCs for CVE-2026-8825
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8825
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-8825 (1)
- 🔗 Elementor < 4.1.4 – Contributor+ Sensitive Information Disclosure via REST API | CVE 2026-8825 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-20 · 18 CVEs total
| CVE-2026-12972 | PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering | |
| CVE-2026-13156 | MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation | |
| CVE-2026-13147 | Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis | |
| CVE-2026-13142 | Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email O | |
| CVE-2026-13432 | ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation | |
| CVE-2026-9833 | Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter | |
| CVE-2026-12898 | All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File W | |
| CVE-2026-12970 | LearnPress < 4.4.1 - Reflected XSS via c_search | |
| CVE-2026-12973 | PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Mo | |
| CVE-2026-11349 | Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_ | |
| CVE-2026-12724 | Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-p | |
| CVE-2026-12723 | Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via | |
| CVE-2026-12592 | SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header | |
| CVE-2026-11868 | WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation | |
| CVE-2026-10081 | Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews | |
| CVE-2026-10724 | Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Rev | |
| CVE-2026-10755 | All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration |
IV. Related Vulnerabilities
Same product: Elementor Website Builder
- CVE-2026-57619
WordPress Elementor Website Builder plugin <= 4.1.3 - Sensit - CVE-2026-49782
WordPress Elementor Website Builder plugin <= 4.1.0 - Broken - CVE-2026-32445
WordPress Elementor Website Builder plugin <= 3.35.5 - Broke - CVE-2026-32352
WordPress Elementor Website Builder plugin <= 3.35.5 - Cross - CVE-2024-50555
WordPress Elementor Website Builder plugin <= 3.29.0 - Cross
Same vendor: Unknown
- CVE-2026-14322
Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval vi - CVE-2026-12987
Events Manager < 7.3.7 - Unauthenticated SQL Injection via P - CVE-2026-12968
Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored - CVE-2026-14184
Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and - CVE-2026-14185
WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update
V. Comments for CVE-2026-8825
No comments yet