Jeg Kit for Elementor <= 3.2.20 - Authenticated (Subscriber+) Missing Authorization to User Enumeration via Element Option and Author Search AJAX Actions
- ID
- WPSEC-2026-0685
- Plugin
- Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress (jeg-elementor-kit)
- Affected
- all versions before 3.2.21
- Remediation
- Update to 3.2.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-10
- Attack surface
- Jeg Kit for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Jeg Kit for Elementor plugin for WordPress is vulnerable to unauthorized access of data via the element option AJAX actions (get_ajax_option) and the 'jeg_find_author' AJAX action (find_ajax_author) in all versions up to, and including, 3.2.20, due to missing capability checks. The element option handler returns each element's field configuration to any logged-in user, including the nonce for the author search. The author search handler checks only that nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to search all site users by login, nicename, email address or URL and get back their user IDs and display names. Matching searches against the email column also lets them work out users' email addresses.
References
- https://wpsec.com/vuln/WPSEC-2026-0685/
- https://plugins.svn.wordpress.org/jeg-elementor-kit/tags/3.2.21/
- https://wordpress.org/plugins/jeg-elementor-kit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS