{"id":"CVE-2026-115949","kind":"vulnerability","aliases":["CVE-2026-115949"],"related":[],"title":"WordPress Better Post & Filter Widgets for Elementor: missing authorization check","description":"Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.","summary":"The Better Post & Filter Widgets for Elementor WordPress plugin has a missing authorization check, so access control is not enforced on some functionality. The sources do not say exactly what an attacker can read or change once that check is bypassed.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Look for the plugin `better-post-filter-widgets-for-elementor` in the WordPress admin plugin list and note its version.\n- unknown","fix":"- Update the plugin to a version newer than `1.9.1`, if the vendor has released one.\n- unknown","status":"open","published_at":"2026-10-26T10:16:52+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:49+00:00","updated_at":"2026-10-26T10:30:49+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T10:30:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the plugin to a version newer than `1.9.1`, if the vendor has released one.\n- unknown","reach":"internet","title":"WordPress Better Post & Filter Widgets for Elementor: missing authorization check","impact":"medium","summary":"The Better Post & Filter Widgets for Elementor WordPress plugin has a missing authorization check, so access control is not enforced on some functionality. The sources do not say exactly what an attacker can read or change once that check is bypassed.","category":"package","nicknames":[],"who_cares":["wordpress","elementor"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access-control bypass on a WordPress site","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the exact affected function, then confirm the required privilege level.","how_to_check":"- Look for the plugin `better-post-filter-widgets-for-elementor` in the WordPress admin plugin list and note its version.\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Better Post & Filter Widgets for Elementor plugin at version `1.9.1` or earlier are affected. The sources do not say which configuration or role is needed to reach the flawed function. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000588,"input_tokens":3336,"output_tokens":509,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115949':13A,16A '-2026':12A,15A '1.9.1':100C 'access':35B,85C 'affect':90C 'allow':81C 'attack':51B 'author':9A,32B,62C 'better':2A,21B,68C,75C,91C 'better-post-filter-widgets-for-elementor':74C 'bypass':60B 'chang':55B 'check':10A,33B,58B 'configur':84C 'control':36B,86C 'cve':11A,14A 'elementor':7A,17B,26B,73C,80C,96C 'enforc':39B 'exact':48B 'exploit':82C 'filter':4A,23B,70C,77C,93C 'function':42B 'incorrect':83C 'issu':89C 'levels.this':88C 'miss':8A,31B,61C 'n/a':98C 'packag':18B 'plugin':28B 'post':3A,22B,69C,76C,92C 'read':53B 'say':47B 'secur':87C 'smart':66C 'sourc':44B 'vulner':63C 'widget':5A,24B,67C,71C,78C,94C 'wordpress':1A,19B,27B 'wp':65C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Better Post & Filter Widgets for Elementor plugin at version `1.9.1` or earlier are affected. The sources do not say which configuration or role is needed to reach the flawed function. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115949","severity":null,"published_at":"2026-10-26T10:16:52+00:00","modified_at":"2026-10-26T10:16:52+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}