Vulnerability · Published Jul 20, 2026 · Assigned by WPScan

CVE-2026-8825Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API

Medium 4.9

In plain English

A medium-severity information exposure in Elementor Website Builder from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.4%top 65.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).

Affected products (as reported)

Vendor	Product	Versions
Unknown	Elementor Website Builder	0 – before 4.1.4

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

https://wpscan.com/vulnerability/d0d6b840-790d-45a3-9b0d-8f77a229e8a9/ exploit, vdb-entry, technical-description