# Better Post & Filter Widgets for Elementor <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tags

- **ID:** WPSEC-2026-1649
- **Plugin:** Better Post & Filter Widgets for Elementor (`better-post-filter-widgets-for-elementor`), https://wordpress.org/plugins/better-post-filter-widgets-for-elementor/
- **Affected versions:** all versions before 1.9.2
- **Fixed in:** 1.9.2 (Update to 1.9.2 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-26)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/better-post-filter-widgets-for-elementor
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1649/

## Description

The Better Post & Filter Widgets for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Custom Field, Image Custom Field, Repeater, User Meta and Author Meta dynamic tags in all versions up to, and including, 1.9.1 due to the tags reading arbitrary post meta, user fields, user meta and site options for any specified object or user ID without restricting fields or checking the content author's permissions. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive data such as other users' email addresses, password hashes, user meta and site option values.

## References

- https://wpsec.com/vuln/WPSEC-2026-1649/
- https://plugins.svn.wordpress.org/better-post-filter-widgets-for-elementor/tags/1.9.2/
- https://wordpress.org/plugins/better-post-filter-widgets-for-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1649/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.