{
 "id": "WPSEC-2026-1649",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1649/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1649/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1649/index.md",
 "title": "Better Post & Filter Widgets for Elementor <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tags",
 "description": "The Better Post & Filter Widgets for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Custom Field, Image Custom Field, Repeater, User Meta and Author Meta dynamic tags in all versions up to, and including, 1.9.1 due to the tags reading arbitrary post meta, user fields, user meta and site options for any specified object or user ID without restricting fields or checking the content author's permissions. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive data such as other users' email addresses, password hashes, user meta and site option values.",
 "plugin": {
  "slug": "better-post-filter-widgets-for-elementor",
  "name": "Better Post & Filter Widgets for Elementor",
  "full_name": "Better Post & Filter Widgets for Elementor",
  "wordpress_org": "https://wordpress.org/plugins/better-post-filter-widgets-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/better-post-filter-widgets-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/better-post-filter-widgets-for-elementor"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.9.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.9.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.9.2",
 "remediation": "Update to 1.9.2 or later.",
 "fix_released": "2026-10-25T04:04:57+00:00",
 "published": "2026-10-26T04:40:55+00:00",
 "updated": "2026-10-25T10:58:08.987902+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1649/",
  "https://plugins.svn.wordpress.org/better-post-filter-widgets-for-elementor/tags/1.9.2/",
  "https://wordpress.org/plugins/better-post-filter-widgets-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/better-post-filter-widgets-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-26"
 }
}