Vulnerabilities / HT Mega Addons for Elementor / WPSEC-2026-3050
HT Mega Addons for Elementor <= 3.2.8 - Unauthenticated Sensitive Information Exposure via 2025 Blog Widget
Medium 5.3
CWE-200Fixed in 3.2.9
- ID
- WPSEC-2026-3050
- Plugin
- HT Mega Addons for Elementor – Elementor Widgets & Template Builder (ht-mega-for-elementor)
- Affected
- from 3.2.0 before 3.2.9
- Remediation
- Update to 3.2.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- HT Mega Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The HT Mega Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the 2025 Blog widget in all versions up to, and including, 3.2.8 due to the widget building excerpts from a post's excerpt or content without checking whether the post is password protected. This makes it possible for unauthenticated attackers to read portions of password-protected posts by viewing a page where the widget is used with excerpts enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-3050/
- https://plugins.svn.wordpress.org/ht-mega-for-elementor/tags/3.2.9/
- https://wordpress.org/plugins/ht-mega-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS