{"id":"CVE-2026-119502","kind":"vulnerability","aliases":["CVE-2026-119502"],"related":[],"title":"Ultimate Store Kit Elementor Addons: missing access control on WordPress plugin","description":"Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 4.0.1.","summary":"Ultimate Store Kit Elementor Addons, a WordPress plugin by BdThemes, has a missing authorization check that lets a user reach functions they should not. The sources do not say which functions an attacker can reach or what data they can read or change.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","runtime","ultimate-store-kit","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `ultimate-store-kit` plugin is installed on the WordPress site and note its version","fix":"- Ultimate Store Kit Elementor Addons: versions through `4.0.1` are affected; a fixed version is unknown","status":"open","published_at":"2026-11-07T10:17:08+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:48+00:00","updated_at":"2026-11-07T10:48:48+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-07T10:48:48Z","model":"claude-haiku-5-5","output":{"fix":"- Ultimate Store Kit Elementor Addons: versions through `4.0.1` are affected; a fixed version is unknown","reach":"internet","title":"Ultimate Store Kit Elementor Addons: missing access control on WordPress plugin","impact":"medium","summary":"Ultimate Store Kit Elementor Addons, a WordPress plugin by BdThemes, has a missing authorization check that lets a user reach functions they should not. The sources do not say which functions an attacker can reach or what data they can read or change.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","elementor","ultimate-store-kit"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to plugin functions; data impact not stated","analyst_note":"Find the vendor advisory or the Wordfence/WPScan record for the ultimate-store-kit plugin to confirm the affected function, the required privilege, and the fixed version.","how_to_check":"- Check whether the `ultimate-store-kit` plugin is installed on the WordPress site and note its version\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Ultimate Store Kit Elementor Addons WordPress plugin at version 4.0.1 or earlier are affected according to the NVD description. The sources do not say whether the flaw needs a logged-in account or a particular plugin setting.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":4240,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119502':14A,17A '-2026':13A,16A '4.0.1':100C 'access':7A,86C 'addon':5A,29B,77C,96C 'affect':91C 'allow':82C 'attack':57B 'author':38B,69C 'bdtheme':34B,72C 'chang':67B 'check':39B 'configur':85C 'control':8A,87C 'cve':12A,15A 'data':62B 'elementor':4A,18B,28B,76C,95C 'exploit':83C 'function':45B,55B 'incorrect':84C 'issu':90C 'kit':3A,23B,27B,75C,81C,94C 'let':41B 'levels.this':89C 'miss':6A,37B,68C 'n/a':98C 'plugin':11A,32B 'reach':44B,59B 'read':65B 'runtim':19B 'say':53B 'secur':88C 'sourc':50B 'store':2A,22B,26B,74C,80C,93C 'ultim':1A,21B,25B,73C,79C,92C 'ultimate-store-kit':20B,78C 'user':43B 'vulner':70C 'wordpress':10A,24B,31B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ultimate Store Kit Elementor Addons WordPress plugin at version 4.0.1 or earlier are affected according to the NVD description. The sources do not say whether the flaw needs a logged-in account or a particular plugin setting.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","runtime","ultimatestorekit","wordpress"],"campaign_type":null,"search_a":"'-119502':14A,17A '-2026':13A,16A 'access':7A 'addon':5A 'control':8A 'cve':12A,15A 'elementor':4A 'kit':3A 'miss':6A 'plugin':11A 'store':2A 'ultim':1A 'wordpress':10A","search_b":"'addon':29B 'attack':57B 'author':38B 'bdtheme':34B 'chang':67B 'check':39B 'data':62B 'elementor':18B,28B 'function':45B,55B 'kit':23B,27B 'let':41B 'miss':37B 'plugin':32B 'reach':44B,59B 'read':65B 'runtim':19B 'say':53B 'sourc':50B 'store':22B,26B 'ultim':21B,25B 'ultimate-store-kit':20B 'user':43B 'wordpress':24B,31B","search_c":"'4.0.1':100C 'access':86C 'addon':77C,96C 'affect':91C 'allow':82C 'author':69C 'bdtheme':72C 'configur':85C 'control':87C 'elementor':76C,95C 'exploit':83C 'incorrect':84C 'issu':90C 'kit':75C,81C,94C 'levels.this':89C 'miss':68C 'n/a':98C 'secur':88C 'store':74C,80C,93C 'ultim':73C,79C,92C 'ultimate-store-kit':78C 'vulner':70C","first_public_at":"2026-11-07T10:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119502","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119502","severity":null,"published_at":"2026-11-07T10:17:08+00:00","modified_at":"2026-11-07T10:17:08+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}