CVE-2026-1206 PUBLISHED

Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

Assigner: Wordfence
Reserved: 19.01.2026 Published: 26.03.2026 Updated: 26.03.2026

The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Vendor elemntor
Product Elementor Website Builder – More Than Just a Page Builder
Versions Default: unaffected
  • affected from * to 3.35.7 (incl.)

Credits

  • Angus Girvan finder

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE