{"id":"CVE-2026-125808","kind":"vulnerability","aliases":["CVE-2026-125808"],"related":[],"title":"HT Mega for Elementor: missing authorization lets unauthorized users access functions","description":"Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8.","summary":"HT Mega for Elementor, a WordPress plugin, has a missing authorization check in versions through 3.2.8. A user without the right permissions may be able to perform actions the site intended only for privileged roles.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ht-mega-for-elementor","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["elementor","ht-mega","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of HT Mega (ht-mega-for-elementor) in the WordPress admin plugin list, looking for `3.2.8` or earlier.","fix":"- Versions above `3.2.8` per the description; the exact fixed version is unknown.","status":"open","published_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","triaged_at":"2026-11-13T15:49:04+00:00","updated_at":"2026-11-13T15:49:04+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-13T15:49:04Z","model":"claude-haiku-5-5","output":{"fix":"- Versions above `3.2.8` per the description; the exact fixed version is unknown.","reach":"internet","title":"HT Mega for Elementor: missing authorization lets unauthorized users access functions","impact":"medium","summary":"HT Mega for Elementor, a WordPress plugin, has a missing authorization check in versions through 3.2.8. A user without the right permissions may be able to perform actions the site intended only for privileged roles.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","elementor","ht-mega"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; access control bypass on the affected WordPress site","analyst_note":"Find the exact fixed version and the specific functions lacking authorization in the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-125808 or the vendor changelog.","how_to_check":"- Check the installed version of HT Mega (ht-mega-for-elementor) in the WordPress admin plugin list, looking for `3.2.8` or earlier.\n- unknown","plain_action":"","product_name":"ht-mega-for-elementor","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"unknown. The description says the plugin is affected from n/a through 3.2.8 and names missing authorization on access control, but the sources do not state which functions or roles are exposed. Sites running the plugin on WordPress with Elementor are the likely systems to review.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4548,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125808':14A,17A '-2026':13A,16A '3.2.8':44B,91C 'abl':53B 'access':10A,80C 'action':56B 'affect':85C 'allow':76C 'author':6A,39B,65C 'check':40B 'configur':79C 'control':81C 'cve':12A,15A 'elementor':4A,22A,23B,32B,75C 'exploit':77C 'for':21A 'function':11A 'ht':1A,19A,25B,29B,69C,72C,86C 'ht-mega':24B 'ht-mega-for-elementor':18A,71C 'htmega':68C 'incorrect':78C 'intend':59B 'issu':84C 'let':7A 'levels.this':83C 'may':51B 'mega':2A,20A,26B,30B,70C,73C,87C 'miss':5A,38B,64C 'n/a':89C 'perform':55B 'permiss':50B 'plugin':35B 'privileg':62B 'right':49B 'role':63B 'secur':82C 'site':58B 'unauthor':8A 'user':9A,46B 'version':42B 'vulner':66C 'without':47B 'wordpress':28B,34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["htmegaforelementor"],"ptokens":["elementor","for","ht","mega"],"labels":["elementor","htmega","medium","other","vendor","wordpress"],"campaign_type":null,"search_a":"'-125808':14A,17A '-2026':13A,16A 'access':10A 'author':6A 'cve':12A,15A 'elementor':4A,22A 'for':21A 'function':11A 'ht':1A,19A 'ht-mega-for-elementor':18A 'let':7A 'mega':2A,20A 'miss':5A 'unauthor':8A 'user':9A","search_b":"'3.2.8':44B 'abl':53B 'action':56B 'author':39B 'check':40B 'elementor':23B,32B 'ht':25B,29B 'ht-mega':24B 'intend':59B 'may':51B 'mega':26B,30B 'miss':38B 'perform':55B 'permiss':50B 'plugin':35B 'privileg':62B 'right':49B 'role':63B 'site':58B 'user':46B 'version':42B 'without':47B 'wordpress':28B,34B","search_c":"'3.2.8':91C 'access':80C 'affect':85C 'allow':76C 'author':65C 'configur':79C 'control':81C 'elementor':75C 'exploit':77C 'ht':69C,72C,86C 'ht-mega-for-elementor':71C 'htmega':68C 'incorrect':78C 'issu':84C 'levels.this':83C 'mega':70C,73C,87C 'miss':64C 'n/a':89C 'secur':82C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125808","severity":null,"published_at":"2026-11-13T15:17:40+00:00","modified_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","fetched_at":"2026-11-13T15:46:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}