---
id: "CVE-2026-110509"
kind: "vulnerability"
aliases: ["CVE-2026-110509"]
title: "Essential Addons for Elementor: unauthenticated visitors can read private post fields"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["default-config"]
published_at: "2026-10-28T06:16:33+00:00"
first_seen_at: "2026-10-28T06:31:27+00:00"
updated_at: "2026-10-28T06:32:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110509", "first_seen_at": "2026-10-28T06:31:27+00:00"}]
---

# Essential Addons for Elementor: unauthenticated visitors can read private post fields

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query that an unauthenticated visitor sends to its pagination endpoint. An attacker can read content from non-public post types and recover values of private custom fields on published posts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Essential Addons for Elementor plugin in the WordPress admin under Plugins, or with `wp plugin get essential-addons-for-elementor --field=version`
- Look for the plugin's pagination endpoint in the site's REST API output unknown

## Fix

- Update Essential Addons for Elementor to `6.8.7` or later

## Timeline

- 2026-10-28T06:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110509

## From the sources

The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_