Live › vulnerability › CVE-2026-91047
Go to dashboardThe ElementsReady Addons for Elementor WordPress plugin through 6.7.2 fails to restrict access to protected WooCommerce product downloads. An unauthenticated visitor can skip the payment check and retrieve any product's paid downloadable file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites that run the ElementsReady Addons for Elementor plugin at or earlier together with WooCommerce downloadable products. The paid files are exposed to anyone who can reach the site, with no login needed. Sites without this plugin or without downloadable WooCommerce products can skip it.
6.7.2No product ranges from the sources yet.
6.7.2 or lower, in the WordPress admin plugins list or wp plugin get elementsready-addons-for-elementor6.7.2; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.
This page as .md · .json · in your agent: get_signal("CVE-2026-91047")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.