Vulnerabilities / Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates / WPSEC-2026-1000
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Authenticated (Contributor+) Missing Authorization to Post Publishing via Change Post Status Ability
Low 3.1
CWE-862Fixed in 4.11.112
- ID
- WPSEC-2026-1000
- Plugin
- Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates (premium-addons-for-elementor)
- Affected
- from 4.11.87 before 4.11.112
- Remediation
- Update to 4.11.112 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-15
- Attack surface
- Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates on WPSec AttackSurface
- Fix released
- Published
Description
The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized post publishing via the change-post-status AI ability in versions 4.11.87 up to, and including, 4.11.111. This is due to the ability's permission callback only checking whether the user can edit the post, not whether they hold the post type's publish capability when setting the status to publish or private. This makes it possible for authenticated attackers, with contributor-level access and above, to publish posts they can edit and bypass editorial review, when the plugin's AI Abilities feature is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1000/
- https://plugins.svn.wordpress.org/premium-addons-for-elementor/tags/4.11.112/
- https://wordpress.org/plugins/premium-addons-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS