CVE-2026-8825 — MEDIUM (4.9)

Vulnerability Description

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).

CVSS Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-200

References

https://wpscan.com/vulnerability/d0d6b840-790d-45a3-9b0d-8f77a229e8a9/

FAQ

What is CVE-2026-8825?

CVE-2026-8825 is a vulnerability with a CVSS score of 4.9 (MEDIUM). The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Co...

How severe is CVE-2026-8825?

CVE-2026-8825 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-8825?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.