Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103907— Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action

Quick assessment

Affected
jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 JNews - Jeg Elementor Kit 插件在 3.2.19 及更低版本中，由于对 和 两个 AJAX 操作缺少能力检查（capability check），导致存在未授权数据访问漏洞。 处理器（通过 中的 方式通用注册到每个元素）会将元素的完整选项架构——包括一个新生成的 令牌——返回给任何已认证的调用者。 随后， 处理器会以攻击者提供的包含通配符 的 参数，针对包含 在内的搜索列（search_columns）执行 查询，并回显每个匹配用户的用户 ID 和显示名称。 这使得具

CVSS 6.5 · Medium EPSS 0.31% · P22

Affected Version Matrix 1

VendorProduct Version RangeStatus
jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress ≤ 3.2.19 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103907

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element's full option schema — including a freshly minted wp_create_nonce('jeg_find_author') — to any authenticated caller, and the 'wp_ajax_jeg_find_author' handler then runs a WP_User_Query with the attacker-supplied 'query' wrapped in '*…*' against search_columns that include user_email, echoing the ID and display_name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress 0 ~ 3.2.19 -

II. Public POCs for CVE-2026-103907

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103907

请登录查看更多情报信息。

Other References for CVE-2026-103907 (4)

IV. Related Vulnerabilities

Same product: Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
Same vendor: jegtheme
Same weakness: CWE-862

V. Comments for CVE-2026-103907

No comments yet

Leave a comment