{
 "id": "WPSEC-2026-1003",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1003/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1003/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1003/index.md",
 "title": "Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Unauthenticated Sensitive Information Exposure via Search Form 'post_type' Parameter",
 "description": "The Premium Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Search Form widget's AJAX search (premium_get_search_results) in all versions up to, and including, 4.11.111. This is due to the post type sent in the request being passed straight into the search query without being limited to public, searchable post types. This makes it possible for unauthenticated attackers to search for and read published entries of non-public or search-excluded post types, such as Elementor templates or WooCommerce coupons.",
 "plugin": {
  "slug": "premium-addons-for-elementor",
  "name": "Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates",
  "full_name": "Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates",
  "wordpress_org": "https://wordpress.org/plugins/premium-addons-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/premium-addons-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/premium-addons-for-elementor"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.11.112",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.11.112"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.11.112",
 "remediation": "Update to 4.11.112 or later.",
 "fix_released": "2026-10-14T09:46:08+00:00",
 "published": "2026-10-15T10:51:54+00:00",
 "updated": "2026-10-14T19:51:13.066693+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1003/",
  "https://plugins.svn.wordpress.org/premium-addons-for-elementor/tags/4.11.112/",
  "https://wordpress.org/plugins/premium-addons-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/premium-addons-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-15"
 }
}