CVE-2026-91047
Last modified
CVE-2026-91047 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | ElementsReady Addons for Elementor | <= 6.7.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-91047?
How severe is CVE-2026-91047?
How do I fix CVE-2026-91047?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9103IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote a…9.8
- CVE-2026-91039Authentication Bypass by Spoofing vulnerability in team-alem…9.1
- CVE-2026-9104The Draft List plugin for WordPress is vulnerable to Stored …6.4
- CVE-2026-91041Mounting an attacker-controlled FAT image with fault toleran…7.8
- CVE-2026-91043Allocation of Resources Without Limits or Throttling vulnera…8.2
- CVE-2026-91046The ElementsReady Addons for Elementor WordPress plugin thro…4.3
- CVE-2026-91048The jdbc shell command scope shipped no org.apache.karaf.com…9.8
- CVE-2026-9105An authenticated stack-based buffer overflow vulnerability e…6.5
- CVE-2026-91050The Appointment Booking Plugin – LatePoint | Calendar & Sche…4.3
- CVE-2026-91051The EWWW Image Optimizer WordPress plugin before 8.8.0 does …6.6
- CVE-2026-91057`_gx_multi_line_text_view_display_info_get()` reads one byte…4.6
- CVE-2026-91059The GUIX JPEG software decoder enforces no ordering on JPEG …6.8
Are you affected by CVE-2026-91047?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST