WordPress Plugin Envoy Missing Auth Private Content Disclosure (CVE-2026-11600)

Vulnerability Overview Vulnerability Name: Envoy's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envoy Tabs Widget 'templates' Setting CVE ID: CVE-2026-11600 CVSS Score: 4.3 (Medium) Publication Date: July 1, 2026 Last Updated: July 2, 2026 Researchers: Alessandro Greco (Alerf), Giovanni Battista Ianni - University of Calabria (UNICAL) Affected Scope Software Type: Plugin Software Name: Envoy's Templates & Widgets for Elementor and WooCommerce Affected Versions: <= 1.4.26 Fixed Version: 1.4.27 Remediation Remediation Measure: Update to version 1.4.27 or later. Vulnerability Description This vulnerability exists in the Envoy's Templates & Widgets for Elementor and WooCommerce plugin. Due to a lack of authorization checks, it allows unauthorized data access. Specifically, the method directly passes the post ID to Elementor's method when rendering the Envoy Tabs and Off Canvas widgets, without validating the post status (published/private/draft) or the visitor's authorization level. This enables an attacker with author-level access to disclose the content of private pages and templates by configuring the Envoy Tabs widget to reference the ID of private content on public pages (which can be provided via the Elementor editor REST API by editing the underlying widget JSON). References plugins.trac.wordpress.org Sharing Options Facebook Twitter LinkedIn Email Additional Information Disclaimer: This record contains copyrighted material. Copyright: 2012-2026 Defiant Inc. MITRE Copyright: 1999-2026 The MITRE Corporation Contact Technical Support: 24/7 support, 365 days a year, with a 1-hour response time. Business Hours: 9 AM - 8 PM ET, 6 AM - 5 PM PT, and 2 PM - 1 AM UTC/GMT, excluding weekends and holidays. Other Vulnerabilities Recent Vulnerabilities: The page lists other recent vulnerabilities for Envoy's Templates & Widgets for Elementor and WooCommerce, including Stored Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). Summary This is a medium-severity security issue affecting versions <= 1.4.26 of the Envoy's Templates & Widgets for Elementor and WooCommerce plugin. Users are advised to update to version 1.4.27 or later as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Plugin Envoy Missing Auth Private Content Disclosure (CVE-2026-11600)

More from this source