{
 "id": "WPSEC-2026-2461",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2461/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2461/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2461/index.md",
 "title": "Addon Elements for Elementor (formerly Elementor Addon Elements) <= 1.15 - Authenticated (Contributor+) Sensitive Information Exposure via Random Image Widget",
 "description": "The Addon Elements for Elementor (formerly Elementor Addon Elements) plugin for WordPress is vulnerable to Sensitive Information Exposure via the Random Image widget in versions 1.14 up to, and including, 1.15, due to the widget loading the post referenced by an image item's ID and outputting its excerpt or content as the caption, checking only the read_post capability and not whether the post (or the attachment's parent post) is password-protected. This makes it possible for authenticated attackers, with Contributor-level access and above, to reference the ID of a password-protected post in the widget and read its excerpt or content without knowing the password.",
 "plugin": {
  "slug": "addon-elements-for-elementor-page-builder",
  "name": "Addon Elements for Elementor (formerly Elementor Addon Elements)",
  "full_name": "Addon Elements for Elementor (formerly Elementor Addon Elements)",
  "wordpress_org": "https://wordpress.org/plugins/addon-elements-for-elementor-page-builder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/addon-elements-for-elementor-page-builder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/addon-elements-for-elementor-page-builder"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.14",
    "from_inclusive": true,
    "to": "1.15.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.14 before 1.15.1"
  ]
 },
 "introduced_in": "1.14",
 "fixed_in": "1.15.1",
 "remediation": "Update to 1.15.1 or later.",
 "fix_released": "2026-11-03T09:41:47+00:00",
 "published": "2026-11-04T09:46:28+00:00",
 "updated": "2026-11-03T13:19:10.331098+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2461/",
  "https://plugins.svn.wordpress.org/addon-elements-for-elementor-page-builder/tags/1.15.1/",
  "https://wordpress.org/plugins/addon-elements-for-elementor-page-builder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/addon-elements-for-elementor-page-builder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}