{"id":"CVE-2026-8825","aliases":["EUVD-2026-45892","GHSA-v2ph-jf8x-q5mc"],"status":"published","title":"Elementor \u003c 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API","description":"The Elementor Website Builder  WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00398,"percentile":0.34436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-07-20T06:00:05Z","modified":"2026-07-20T20:39:31Z","products":[{"vendor":"elementor","product":"elementor website builder"},{"vendor":"unknown","product":"elementor website builder"}],"references":[{"url":"https://wpscan.com/vulnerability/d0d6b840-790d-45a3-9b0d-8f77a229e8a9/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8825"},{"url":"https://wpscan.com/vulnerability/d0d6b840-790d-45a3-9b0d-8f77a229e8a9"},{"url":"https://github.com/advisories/GHSA-v2ph-jf8x-q5mc"}],"sources":{"cve":[{"id":"CVE-2026-8825","title":"Elementor \u003c 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API","description":"The Elementor Website Builder  WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).","status":"published","published":"2026-07-20T06:00:05.303Z","modified":"2026-07-20T13:09:48.21Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-45892","description":"The Elementor Website Builder  WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).","status":"published","published":"2026-07-20T06:00:05Z","modified":"2026-07-20T13:09:48Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:49.035342Z"}],"ghsa":[{"id":"GHSA-v2ph-jf8x-q5mc","title":"The Elementor Website Builder  WordPress plugin before 4.1.4 does not properly check user...","description":"The Elementor Website Builder  WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).","status":"published","published":"2026-07-20T09:31:08Z","modified":"2026-07-20T15:32:03Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:09:36.920272Z"}],"nvd":[{"id":"CVE-2026-8825","description":"The Elementor Website Builder  WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).","status":"published","published":"2026-07-20T07:16:42.553Z","modified":"2026-07-20T20:39:31.217Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:31.024898Z"}]}}