{
 "id": "WPSEC-2026-1054",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1054/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1054/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1054/index.md",
 "title": "Animation Addons for Elementor <= 4.2.6 - Authenticated (Contributor+) Sensitive Information Exposure via Toggle Switcher Widget",
 "description": "The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Toggle Switcher widget in all versions up to, and including, 4.2.6 due to the widget rendering any selected Elementor template regardless of its publication status. This makes it possible for authenticated attackers, with contributor-level access and above, to place the widget in their own posts and view the contents of private or draft templates they are not permitted to read.",
 "plugin": {
  "slug": "animation-addons-for-elementor",
  "name": "Animation Addons for Elementor",
  "full_name": "Animation Addons for Elementor – Elementor V4 Atomic Widgets, GSAP Animations & Templates",
  "wordpress_org": "https://wordpress.org/plugins/animation-addons-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/animation-addons-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/animation-addons-for-elementor"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.2.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.2.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.2.7",
 "remediation": "Update to 4.2.7 or later.",
 "fix_released": "2026-10-15T09:35:40+00:00",
 "published": "2026-10-16T10:47:15+00:00",
 "updated": "2026-10-16T09:50:27.823305+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1054/",
  "https://plugins.svn.wordpress.org/animation-addons-for-elementor/tags/4.2.7/",
  "https://wordpress.org/plugins/animation-addons-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/animation-addons-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-16"
 }
}