CVE-2026-91046
Last modified
CVE-2026-91046 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | ElementsReady Addons for Elementor | <= 6.7.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-91046?
How severe is CVE-2026-91046?
How do I fix CVE-2026-91046?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-91025The Booking Manager WordPress plugin before 2.1.21 does not…4.3
- CVE-2026-9103IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote a…9.8
- CVE-2026-91039Authentication Bypass by Spoofing vulnerability in team-alem…9.1
- CVE-2026-9104The Draft List plugin for WordPress is vulnerable to Stored …6.4
- CVE-2026-91041Mounting an attacker-controlled FAT image with fault toleran…7.8
- CVE-2026-91043Allocation of Resources Without Limits or Throttling vulnera…8.2
- CVE-2026-91047The ElementsReady Addons for Elementor WordPress plugin thro…5.3
- CVE-2026-91048The jdbc shell command scope shipped no org.apache.karaf.com…9.8
- CVE-2026-9105An authenticated stack-based buffer overflow vulnerability e…6.5
- CVE-2026-91050The Appointment Booking Plugin – LatePoint | Calendar & Sche…4.3
- CVE-2026-91051The EWWW Image Optimizer WordPress plugin before 8.8.0 does …6.6
- CVE-2026-91057`_gx_multi_line_text_view_display_info_get()` reads one byte…4.6
Are you affected by CVE-2026-91046?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST