Live › vulnerability › CVE-2026-110509
Go to dashboardThe Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query that an unauthenticated visitor sends to its pagination endpoint. An attacker can read content from non-public post types and recover values of private custom fields on published posts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Essential Addons for Elementor plugin older than 6.8.7 that expose its pagination endpoint to anonymous visitors are exposed. Sites without the plugin, or running 6.8.7 or later, are not affected.
No product ranges from the sources yet.
wp plugin get essential-addons-for-elementor --field=version6.8.7 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.
This page as .md · .json · in your agent: get_signal("CVE-2026-110509")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.