CVE-2026-49053

Vulnerability

A missing authorization vulnerability exists in the ElementsKit Elementor addons Lite plugin for WordPress, affecting versions from n/a through 3.9.6. The plugin fails to properly enforce access controls on certain functions, allowing exploitation of incorrectly configured access control security levels [1].

Exploitation

An attacker can exploit this vulnerability without requiring authentication or with minimal privileges, by sending crafted requests to endpoints that lack authorization checks [1]. The exact steps depend on the specific missing check, but the attack can be carried out remotely.

Impact

Successful exploitation allows an unprivileged attacker to perform actions reserved for higher-privileged users, potentially leading to unauthorized data modification, disclosure, or other administrative actions [1]. This can compromise the security of the WordPress site.

Mitigation

The vulnerability affects ElementsKit Elementor addons Lite version 3.9.6 and earlier. As a mitigation, users should update the plugin to the latest available version (beyond 3.9.6) as recommended by the source [1]. No other workaround is provided.