CVE-2026-8825

MediumCVSS 4.9/10Last modified Jul 20, 2026

Description

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Unknown	Elementor Website Builder	< 4.1.4

References

https://wpscan.com/vulnerability/d0d6b840-790d-45a3-9b0d-8f77a229e8a9/

Timeline

Published: Jul 20, 2026
Last modified: Jul 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-882525.5A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors CVE-2026-882556.3Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submis CVE-2026-882575.3Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function CVE-2026-882597.5CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with CVE-2026-882608.7Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzco CVE-2026-882615.1Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.1.CVE-2026-882628.7Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick: R2, R3, and R3.1.CVE-2026-882638.7XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration dat CVE-2026-882645.6A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console on CVE-2026-882655.6A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, th CVE-2026-882664.3An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-860 CVE-2026-882686.5GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the