{"id":"CVE-2026-110509","kind":"vulnerability","aliases":["CVE-2026-110509"],"related":[],"title":"Essential Addons for Elementor: unauthenticated visitors can read private post fields","description":"The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.","summary":"The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query that an unauthenticated visitor sends to its pagination endpoint. An attacker can read content from non-public post types and recover values of private custom fields on published posts.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed version of the Essential Addons for Elementor plugin in the WordPress admin under Plugins, or with `wp plugin get essential-addons-for-elementor --field=version`\n- Look for the plugin's pagination endpoint in the site's REST API output unknown","fix":"- Update Essential Addons for Elementor to `6.8.7` or later","status":"open","published_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:42+00:00","updated_at":"2026-10-28T06:32:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update Essential Addons for Elementor to `6.8.7` or later","reach":"internet","title":"Essential Addons for Elementor: unauthenticated visitors can read private post fields","impact":"medium","summary":"The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query that an unauthenticated visitor sends to its pagination endpoint. An attacker can read content from non-public post types and recover values of private custom fields on published posts.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Private custom field values and non-public content readable by anonymous visitors","analyst_note":"Check the NVD entry and the plugin changelog for 6.8.7 to confirm which endpoint and meta keys are exposed and whether the pagination endpoint is enabled by default.","how_to_check":"- Check the installed version of the Essential Addons for Elementor plugin in the WordPress admin under Plugins, or with `wp plugin get essential-addons-for-elementor --field=version`\n- Look for the plugin's pagination endpoint in the site's REST API output unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running the Essential Addons for Elementor plugin older than 6.8.7 that expose its pagination endpoint to anonymous visitors are exposed. Sites without the plugin, or running 6.8.7 or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3306,"output_tokens":568,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110509':14A,17A '-2026':13A,16A '6.8.7':32B,80C 'addon':2A,26B,74C 'allow':101C 'attack':52B 'content':55B,105C 'could':100C 'custom':67B,118C 'cve':12A,15A 'elementor':4A,18B,28B,76C 'endpoint':50B,98C 'essenti':1A,25B,73C 'field':11A,68B,119C 'host':22B 'meta':40B,88C 'non':58B,108C 'non-publ':57B,107C 'packag':19B 'pagin':49B,97C 'pass':94C 'plugin':30B,78C 'post':10A,37B,60B,71B,85C,110C,122C 'privat':9A,66B,117C 'public':59B,109C 'publish':70B,121C 'queri':41B,89C 'read':8A,54B,104C 'recov':63B,113C 'restrict':35B,83C 'self':21B 'self-host':20B 'send':46B 'type':38B,61B,86C,111C 'unauthent':5A,44B,91C 'valu':64B,115C 'visitor':6A,45B,92C 'wordpress':23B,29B,77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Essential Addons for Elementor plugin older than 6.8.7 that expose its pagination endpoint to anonymous visitors are exposed. Sites without the plugin, or running 6.8.7 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110509","severity":null,"published_at":"2026-10-28T06:16:33+00:00","modified_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}