CVE-2026-1206: Elementor Info Disclosure Vulnerability

CVE-2026-1206 Overview

CVE-2026-1206 affects the Elementor Website Builder plugin for WordPress in all versions up to and including 3.35.7. The vulnerability results from a logic error in the is_allowed_to_read_template() permission check. The function treats non-published templates as readable without verifying edit capabilities. Authenticated attackers with contributor-level access or above can read private or draft Elementor template content. Exploitation occurs through the template_id parameter supplied to the get_template_data action of the elementor_ajax endpoint. The flaw is categorized under [CWE-639] (Authorization Bypass Through User-Controlled Key).

Critical Impact

Authenticated contributors can access private and draft template content they should not be permitted to read, exposing sensitive design data and unpublished content.

Affected Products

• Elementor Website Builder plugin for WordPress
• All versions up to and including 3.35.7
• WordPress sites with contributor-level or higher user accounts

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-1206 published to NVD
• 2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-1206

Vulnerability Analysis

The vulnerability resides in the is_allowed_to_read_template() function inside the Elementor template library source local.php. The function evaluates whether a user can read a given template but contains a logic flaw in how it handles template publication state. Non-published templates such as drafts and private templates are treated as readable without confirming that the requesting user has the necessary edit capabilities. This permission check inversion exposes unpublished template content to lower-privileged authenticated users.

Exploitation requires only contributor-level access, a role commonly granted on multi-author WordPress sites. The attack provides confidentiality impact without modifying integrity or availability.

Root Cause

The root cause is an authorization logic error. The permission gate assumes that non-published templates are publicly accessible, when in fact they should require edit capability verification on the underlying post object. The function omits a capability check such as current_user_can('edit_post', $template_id) before returning template data for drafts or private posts.

Attack Vector

An authenticated attacker sends a crafted POST request to admin-ajax.php invoking the elementor_ajax endpoint with the get_template_data action and a target template_id. Because the permission check returns true for non-published templates, the endpoint returns the template body to the contributor. The attacker can enumerate template IDs to retrieve drafts and private templates belonging to editors and administrators.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Change Log for the patched function logic.

Detection Methods for CVE-2026-1206

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php containing action=elementor_ajax paired with actions parameters invoking get_template_data.
• Sequential or enumerated values of the template_id parameter from a single authenticated contributor session.
• Contributor or author accounts accessing template IDs that correspond to draft or private posts they do not own.

Detection Strategies

• Review WordPress access logs for elementor_ajax requests originating from low-privileged user sessions.
• Correlate template_id values in request logs against the post status of each template to identify draft and private retrievals.
• Alert on bursts of get_template_data calls from a single user agent or session within short time windows.

Monitoring Recommendations

• Enable verbose request logging for admin-ajax.php and forward to a centralized SIEM for retention and query.
• Monitor for new or recently elevated contributor accounts performing template enumeration activity.
• Track outbound transfers of template JSON payloads from WordPress hosts to unusual destinations.

How to Mitigate CVE-2026-1206

Immediate Actions Required

• Update the Elementor Website Builder plugin to a version newer than 3.35.7 that contains the patched is_allowed_to_read_template() function.
• Audit WordPress user accounts and remove unused contributor, author, or higher-privileged accounts.
• Review historical access logs for prior exploitation attempts targeting the elementor_ajax endpoint.

Patch Information

The fix is committed in the Elementor source repository as referenced in the WordPress Plugin Change Log. The patch adds proper capability verification within the is_allowed_to_read_template() permission check so that non-published templates require edit capability before their content is returned.

Workarounds

• Restrict contributor registrations and require administrator approval for new low-privileged accounts until the plugin is updated.
• Use a web application firewall rule to block elementor_ajax requests with the get_template_data action from non-editor roles.
• Temporarily disable the Elementor template library AJAX endpoint on sites that cannot patch immediately.

# Update Elementor plugin via WP-CLI
wp plugin update elementor
wp plugin get elementor --field=version