CVE-2026-2295

The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_post_grid_load_more' function in all versions up to, and including, 1.3.2. This makes it possible for unauthenticated attackers to retrieve protected (draft, future, pending) post titles and excerpts that should not be accessible to unauthenticated users.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.3.1/includes/wpzoom-elementor-ajax-posts-grid.php#L66
https://plugins.trac.wordpress.org/changeset/3458416/wpzoom-elementor-addons
https://www.wordfence.com/threat-intel/vulnerabilities/id/b9961347-7c47-4fa1-af35-609c39a6cd8b?source=cve

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) El plugin WPZOOM Addons para Elementor – Starter Templates & Widgets para WordPress es vulnerable a acceso no autorizado a datos debido a una comprobación de capacidad faltante en la función 'ajax_post_grid_load_more' en todas las versiones hasta la 1.3.2, ambas inclusive. Esto hace posible que atacantes no autenticados recuperen títulos y extractos de publicaciones protegidas (borrador, futuras, pendientes) que no deberían ser accesibles para usuarios no autenticados.

11 Feb 2026, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-11 10:15

Updated : 2026-06-17 10:30

NVD link : CVE-2026-2295

Mitre link : CVE-2026-2295

CVE.ORG link : CVE-2026-2295

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-2295", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2295", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:20:23.230467Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "wpzoom", "product": "WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-02-11T10:15:51.357", "references": [{"url": "https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.3.1/includes/wpzoom-elementor-ajax-posts-grid.php#L66", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3458416/wpzoom-elementor-addons", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b9961347-7c47-4fa1-af35-609c39a6cd8b?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_post_grid_load_more' function in all versions up to, and including, 1.3.2. This makes it possible for unauthenticated attackers to retrieve protected (draft, future, pending) post titles and excerpts that should not be accessible to unauthenticated users."}, {"lang": "es", "value": "El plugin WPZOOM Addons para Elementor \u2013 Starter Templates & Widgets para WordPress es vulnerable a acceso no autorizado a datos debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n 'ajax_post_grid_load_more' en todas las versiones hasta la 1.3.2, ambas inclusive. Esto hace posible que atacantes no autenticados recuperen t\u00edtulos y extractos de publicaciones protegidas (borrador, futuras, pendientes) que no deber\u00edan ser accesibles para usuarios no autenticados."}], "lastModified": "2026-06-17T10:30:44.387", "sourceIdentifier": "security@wordfence.com"}