# Addon Elements for Elementor (formerly Elementor Addon Elements) <= 1.15 - Authenticated (Contributor+) Sensitive Information Exposure via Random Image Widget

- **ID:** WPSEC-2026-2461
- **Plugin:** Addon Elements for Elementor (formerly Elementor Addon Elements) (`addon-elements-for-elementor-page-builder`), https://wordpress.org/plugins/addon-elements-for-elementor-page-builder/
- **Affected versions:** from 1.14 before 1.15.1
- **Fixed in:** 1.15.1 (Update to 1.15.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/addon-elements-for-elementor-page-builder
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2461/

## Description

The Addon Elements for Elementor (formerly Elementor Addon Elements) plugin for WordPress is vulnerable to Sensitive Information Exposure via the Random Image widget in versions 1.14 up to, and including, 1.15, due to the widget loading the post referenced by an image item's ID and outputting its excerpt or content as the caption, checking only the read_post capability and not whether the post (or the attachment's parent post) is password-protected. This makes it possible for authenticated attackers, with Contributor-level access and above, to reference the ID of a password-protected post in the widget and read its excerpt or content without knowing the password.

## References

- https://wpsec.com/vuln/WPSEC-2026-2461/
- https://plugins.svn.wordpress.org/addon-elements-for-elementor-page-builder/tags/1.15.1/
- https://wordpress.org/plugins/addon-elements-for-elementor-page-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2461/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.