CVE-2026-8825

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).

CVSS v3.1

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.40% chance of exploitation in the next 30 days, 33th percentile

Published

2026-07-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d0d6b840-790d-45a3-9b0d-8f77a229e8a9/

References

• CVE Record
• NVD entry

Related

• CVE-2026-8809
• CVE-2026-8832
• CVE-2026-8794
• CVE-2026-8836
• CVE-2026-8786
• CVE-2026-8838