Medium severity · published Jul 20, 2026
CVE-2026-8825
Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EW
Elementor Website Builder ·
before 4.1.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8825
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8825
wpscan.com
https://wpscan.com/vulnerability/d0d6b840-790d-45a3-9b0d-8f77a229e8a9/
More from Elementor Website Builder
7.2
CVE-2023-0329
Elementor Website Builder < 3.12.2 - Admin+ SQLi
6.8
CVE-2026-81813
Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
6.4
CVE-2026-81812
Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
6.1
CVE-2022-4953
Elementor < 3.5.5 - Iframe Injection