CVE-2026-110509— Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler

Quick assessment

Affected

Unknown Essential Addons for Elementor

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Elementor 的 Essential Addons 插件在 6.8.7 版本之前，未对未认证访客可传递给其分页端点的文章类型（post type）或元数据查询（meta query）进行限制。这可能导致攻击者读取非公开文章类型的内容，并恢复已发布文章中私有自定义字段的值。

AI Predicted 5.5 Difficulty: Trivial Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1082 · System Information Discovery T1040 · Network Sniffing

Updated Oct 28, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler

Source: CVE Program / CVE List V5

Vulnerability Description

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Essential Addons for Elementor	0 ~ 6.8.7	-

II. Public POCs for CVE-2026-110509

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-110509

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-110509

Same Patch Batch · Unknown · 2026-10-28 · 42 CVEs total

CVE-2026-110508	5.3 MEDIUM	Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypas
CVE-2026-106648	5.3 MEDIUM	Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection vi
CVE-2026-103330	5.3 MEDIUM	Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature
CVE-2026-103313	5.3 MEDIUM	BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Retur
CVE-2026-115223	4.9 MEDIUM	Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
CVE-2026-110691		WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update
CVE-2026-103331		UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via
CVE-2026-110524		Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode
CVE-2026-107100		Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclos
CVE-2026-110506		Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
CVE-2026-110292		PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Can
CVE-2026-110507		Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop
CVE-2026-106002		Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion
CVE-2026-106003		Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion
CVE-2026-106647		Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget
CVE-2026-107098		Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widge
CVE-2026-107097		Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection vi
CVE-2026-103382		Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confi
CVE-2026-103688		Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
CVE-2026-105972		WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribu

Showing top 20 of 42 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Essential Addons for Elementor

Same vendor: Unknown