PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.2 - Authenticated (Subscriber+) Missing Authorization to Post, Template and User Name Disclosure via Query Control
- ID
- WPSEC-2026-1790
- Plugin
- PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (powerpack-lite-for-elementor)
- Affected
- all versions before 3.1.3
- Remediation
- Update to 3.1.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) on WPSec AttackSurface
- Fix released
- Published
Description
The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to unauthorized access of data via the query control autocomplete and value title actions (pp_query_control_filter_autocomplete, pp_query_control_value_titles) in all versions up to, and including, 3.1.2, due to a missing capability check. The handlers are protected only by Elementor's AJAX nonce, which is printed on every admin page. They accept any post type, do not restrict results to published content, and search users by login without requiring the list_users capability. This makes it possible for authenticated attackers with subscriber-level access and above to list the titles of draft, pending and scheduled posts and Elementor templates, and to retrieve user IDs and display names by searching user logins.
References
- https://wpsec.com/vuln/WPSEC-2026-1790/
- https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.1.3/
- https://wordpress.org/plugins/powerpack-lite-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS