CVE-2026-110509

The Essential Addons for Elementor WordPress plugin (versions before 6.8.7 ) is vulnerable to unauthorized data disclosure. The root cause is a failure to restrict the post type or meta query parameters passed by unauthenticated visitors to the plugin's pagination endpoint (specifically the load_...

CVE-2026-110509 Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on publish...