CVE-2026-11905— Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
Quick assessment
Affected
elemntor Elementor Website Builder – more than just a page builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Elementor 网站构建器 – 不仅是 WordPress 的一个页面构建器插件 – 在所有不高于 4.2.3 的版本中存在敏感信息泄露漏洞，该漏洞可通过 'keys_conversion_map' 参数触发。这使得拥有贡献者级别及以上权限的认证攻击者能够提取属于任何作者（包括管理员和编辑）的私有、草稿、待审核以及未来发布状态的完整 post_content 和明文 post_password。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| elemntor | Elementor Website Builder – more than just a page builder | ≤ 4.2.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-11905
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
Source: CVE Program / CVE List V5
Vulnerability Description
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full post_content and plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| elemntor | Elementor Website Builder – more than just a page builder | 0 ~ 4.2.3 | - |
|
II. Public POCs for CVE-2026-11905
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11905
请登录查看更多情报信息。
Other References for CVE-2026-11905 (9)
IV. Related Vulnerabilities
-
CVE-2026-6127
Elementor Website Builder <= 4.0.4 - Authenticated (Contribu -
CVE-2025-14732
Elementor Website Builder <= 3.35.5 - Authenticated (Contrib -
CVE-2026-1206
Elementor Website Builder <= 3.35.7 - Incorrect Authorizatio -
CVE-2025-11220
Elementor <= 3.33.3 - Authenticated (Contributor+) Stored D -
CVE-2025-8081
Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitra
Same vendor: elemntor
-
CVE-2026-5727
Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing A -
CVE-2026-5821
Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary -
CVE-2026-7567
Temporary Login <= 1.0.0 - Authentication Bypass to Account -
CVE-2026-6127
Elementor Website Builder <= 4.0.4 - Authenticated (Contribu -
CVE-2025-14732
Elementor Website Builder <= 3.35.5 - Authenticated (Contrib
Same weakness: CWE-862
-
CVE-2026-18799
Mattermost Server fails to restrict Slack import account bin -
CVE-2026-18795
Missing server side validation allowed user to quarantine a -
CVE-2026-110366
WordPress Site Reviews plugin <= 8.3.4 - Broken Access Contr -
CVE-2026-19798
WP Map Block <= 3.0.0 - Missing Authorization to Authenticat -
CVE-2026-107770
Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missin
V. Comments for CVE-2026-11905
No comments yet