# PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.2 - Authenticated (Subscriber+) Missing Authorization to Post, Template and User Name Disclosure via Query Control

- **ID:** WPSEC-2026-1790
- **Plugin:** PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (`powerpack-lite-for-elementor`), https://wordpress.org/plugins/powerpack-lite-for-elementor/
- **Affected versions:** all versions before 3.1.3
- **Fixed in:** 3.1.3 (Update to 3.1.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1790/

## Description

The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to unauthorized access of data via the query control autocomplete and value title actions (pp_query_control_filter_autocomplete, pp_query_control_value_titles) in all versions up to, and including, 3.1.2, due to a missing capability check. The handlers are protected only by Elementor's AJAX nonce, which is printed on every admin page. They accept any post type, do not restrict results to published content, and search users by login without requiring the list_users capability. This makes it possible for authenticated attackers with subscriber-level access and above to list the titles of draft, pending and scheduled posts and Elementor templates, and to retrieve user IDs and display names by searching user logins.

## References

- https://wpsec.com/vuln/WPSEC-2026-1790/
- https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.1.3/
- https://wordpress.org/plugins/powerpack-lite-for-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1790/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.