---
id: "CVE-2026-91047"
kind: "vulnerability"
aliases: ["CVE-2026-91047"]
title: "ElementsReady Addons for Elementor: unauthenticated users download paid WooCommerce files"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["no-downloadable-products", "plugin-not-installed"]
published_at: "2026-10-19T06:17:25+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:26:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91047", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# ElementsReady Addons for Elementor: unauthenticated users download paid WooCommerce files

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 fails to restrict access to protected WooCommerce product downloads. An unauthenticated visitor can skip the payment check and retrieve any product's paid downloadable file.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the ElementsReady Addons for Elementor plugin is installed and its version is `6.7.2` or lower, in the WordPress admin plugins list or `wp plugin get elementsready-addons-for-elementor`
- Check whether the store sells downloadable products through WooCommerce
- unknown for whether the sources list the exact vulnerable endpoint

## Fix

- Update the ElementsReady Addons for Elementor plugin to a version later than `6.7.2`; the sources do not name the fixed version
- If no fixed version is available, deactivate the plugin or restrict downloads to paying customers at the web server level

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91047

## From the sources

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_