# Jeg Kit for Elementor <= 3.2.20 - Authenticated (Subscriber+) Missing Authorization to User Enumeration via Element Option and Author Search AJAX Actions

- **ID:** WPSEC-2026-0685
- **Plugin:** Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress (`jeg-elementor-kit`), https://wordpress.org/plugins/jeg-elementor-kit/
- **Affected versions:** all versions before 3.2.21
- **Fixed in:** 3.2.21 (Update to 3.2.21 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/jeg-elementor-kit
- **Fix released:** 2026-10-08
- **Published:** 2026-10-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0685/

## Description

The Jeg Kit for Elementor plugin for WordPress is vulnerable to unauthorized access of data via the element option AJAX actions (get_ajax_option) and the 'jeg_find_author' AJAX action (find_ajax_author) in all versions up to, and including, 3.2.20, due to missing capability checks. The element option handler returns each element's field configuration to any logged-in user, including the nonce for the author search. The author search handler checks only that nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to search all site users by login, nicename, email address or URL and get back their user IDs and display names. Matching searches against the email column also lets them work out users' email addresses.

## References

- https://wpsec.com/vuln/WPSEC-2026-0685/
- https://plugins.svn.wordpress.org/jeg-elementor-kit/tags/3.2.21/
- https://wordpress.org/plugins/jeg-elementor-kit/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0685/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.