Better Post & Filter Widgets for Elementor <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tags
- ID
- WPSEC-2026-1649
- Plugin
- Better Post & Filter Widgets for Elementor (better-post-filter-widgets-for-elementor)
- Affected
- all versions before 1.9.2
- Remediation
- Update to 1.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-26
- Attack surface
- Better Post & Filter Widgets for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Better Post & Filter Widgets for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Custom Field, Image Custom Field, Repeater, User Meta and Author Meta dynamic tags in all versions up to, and including, 1.9.1 due to the tags reading arbitrary post meta, user fields, user meta and site options for any specified object or user ID without restricting fields or checking the content author's permissions. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive data such as other users' email addresses, password hashes, user meta and site option values.
References
- https://wpsec.com/vuln/WPSEC-2026-1649/
- https://plugins.svn.wordpress.org/better-post-filter-widgets-for-elementor/tags/1.9.2/
- https://wordpress.org/plugins/better-post-filter-widgets-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS