UiCore Elements <= 1.3.18 - Unauthenticated Sensitive Information Exposure via 'current_query' Parameter
- ID
- WPSEC-2026-2900
- Plugin
- UiCore Elements – Free widgets and templates for Elementor (uicore-elements)
- Affected
- from 1.0.11 before 1.3.19
- Remediation
- Update to 1.3.19 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- UiCore Elements on WPSec AttackSurface
- Fix released
- Published
Description
The UiCore Elements plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'current_query' parameter of the public uielem/v1/load_more REST endpoint used by the Advanced Post widgets in all versions up to, and including, 1.3.18, due to the client-supplied JSON query being decoded and passed unfiltered into WP_Query. This makes it possible for unauthenticated attackers to set arbitrary query variables such as post_status and post_type and retrieve the rendered content of draft, private, or otherwise non-public posts, provided a post widget configured to use the 'current' query exists on the site.
References
- https://wpsec.com/vuln/WPSEC-2026-2900/
- https://plugins.svn.wordpress.org/uicore-elements/tags/1.3.19/
- https://wordpress.org/plugins/uicore-elements/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS