Live › vulnerability › CVE-2026-91046
Go to dashboardThe ElementsReady Addons for Elementor WordPress plugin through 6.7.2 has settings-save handlers that skip authorization checks, so any logged-in subscriber can change them. An attacker can overwrite stored API credentials and feature or template configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the ElementsReady Addons for Elementor plugin through 6.7.2 that allow user registration or have subscriber-level accounts are exposed. Sites without that plugin, or where registration is closed and no untrusted accounts exist, have a much smaller exposure.
No product ranges from the sources yet.
6.7.2.6.7.2 once the vendor ships one; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-91046")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.