Unscored severity · published Oct 28, 2026
CVE-2026-110509
Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler
New
–
CVSS
–
EPSS
No
On KEV
Description
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Essential Addons for Elementor ·
before 6.8.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110509
exploit
https://wpscan.com/vulnerability/da6d12c7-e612-48de-9a57-9d41c36fd409/
More from Essential Addons for Elementor
8.1
CVE-2026-18039
Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment
5.3
CVE-2026-110508
Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification
5.3
CVE-2026-13345
Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table
4.8
CVE-2026-13344
Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag
3.8
CVE-2026-110537
Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action