{"id":"CVE-2026-91047","kind":"vulnerability","aliases":["CVE-2026-91047"],"related":[],"title":"ElementsReady Addons for Elementor: unauthenticated users download paid WooCommerce files","description":"The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.","summary":"The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 fails to restrict access to protected WooCommerce product downloads. An unauthenticated visitor can skip the payment check and retrieve any product's paid downloadable file.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","woocommerce","wordpress"],"not_affected_if":["no-downloadable-products","plugin-not-installed"],"how_to_check":"- Check whether the ElementsReady Addons for Elementor plugin is installed and its version is `6.7.2` or lower, in the WordPress admin plugins list or `wp plugin get elementsready-addons-for-elementor`\n- Check whether the store sells downloadable products through WooCommerce\n- unknown for whether the sources list the exact vulnerable endpoint","fix":"- Update the ElementsReady Addons for Elementor plugin to a version later than `6.7.2`; the sources do not name the fixed version\n- If no fixed version is available, deactivate the plugin or restrict downloads to paying customers at the web server level","status":"open","published_at":"2026-10-19T06:17:25+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:26:38+00:00","updated_at":"2026-10-25T04:26:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:26:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update the ElementsReady Addons for Elementor plugin to a version later than `6.7.2`; the sources do not name the fixed version\n- If no fixed version is available, deactivate the plugin or restrict downloads to paying customers at the web server level","reach":"internet","title":"ElementsReady Addons for Elementor: unauthenticated users download paid WooCommerce files","impact":"medium","summary":"The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 fails to restrict access to protected WooCommerce product downloads. An unauthenticated visitor can skip the payment check and retrieve any product's paid downloadable file.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","elementor","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Anyone can download paid product files without paying","analyst_note":"Confirm the fixed plugin version and the affected download endpoint from the NVD entry or the plugin changelog.","how_to_check":"- Check whether the ElementsReady Addons for Elementor plugin is installed and its version is `6.7.2` or lower, in the WordPress admin plugins list or `wp plugin get elementsready-addons-for-elementor`\n- Check whether the store sells downloadable products through WooCommerce\n- unknown for whether the sources list the exact vulnerable endpoint","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-downloadable-products"],"who_is_affected":"Sites that run the ElementsReady Addons for Elementor plugin at `6.7.2` or earlier together with WooCommerce downloadable products. The paid files are exposed to anyone who can reach the site, with no login needed. Sites without this plugin or without downloadable WooCommerce products can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":3310,"output_tokens":669,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-91047':13A,16A '6.7.2':32B,66C 'access':36B,71C 'addon':2A,26B,60C 'allow':77C 'bypass':81C 'check':49B 'cve':11A,14A 'download':7A,41B,56B,76C,91C 'elementor':4A,17B,28B,62C 'elementsreadi':1A,25B,59C 'fail':33B 'file':10A,57B,92C 'host':21B 'packag':18B 'paid':8A,55B,90C 'payment':48B,83C 'plugin':30B,64C 'product':40B,53B,75C,88C 'proper':69C 'protect':38B,73C 'requir':84C 'restrict':35B,70C 'retriev':51B,86C 'self':20B 'self-host':19B 'skip':46B 'unauthent':5A,43B,78C 'user':6A,79C 'visitor':44B 'woocommerc':9A,22B,39B,74C 'wordpress':23B,29B,63C","nicknames":[],"mitigations":[],"who_affected":"Sites that run the ElementsReady Addons for Elementor plugin at `6.7.2` or earlier together with WooCommerce downloadable products. The paid files are exposed to anyone who can reach the site, with no login needed. Sites without this plugin or without downloadable WooCommerce products can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91047","severity":null,"published_at":"2026-10-19T06:17:25+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}