VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jun 2, 2026· Updated Jun 2, 2026

CVE-2026-49782

CVE-2026-49782

Description

Elementor Website Builder versions prior to 4.1.1 have a missing authorization vulnerability allowing unauthorized privileged actions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Elementor Website Builder versions prior to 4.1.1 have a missing authorization vulnerability allowing unauthorized privileged actions.

Vulnerability

Elementor Website Builder versions from n/a through 4.1.0 contain a missing authorization vulnerability. This issue arises from incorrectly configured access control security levels within the plugin, allowing for the exploitation of broken access control [1].

Exploitation

An attacker can exploit this vulnerability by leveraging a missing authorization, authentication, or nonce token check in a function. This allows an unprivileged user to execute actions typically reserved for higher privileged users [1].

Impact

Successful exploitation of this vulnerability could allow an unprivileged user to perform higher privileged actions. The available references indicate this issue has a low severity impact and is unlikely to be exploited [1].

Mitigation

Update Elementor Website Builder to version 4.1.1 or later to resolve this vulnerability. If an immediate update is not possible, users are advised to seek assistance from their hosting provider or web developer [1].

References
  1. Broken Access Control in WordPress Elementor Website Builder Plugin

AI Insight generated on Jun 2, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

1
3bef116ced70

Internal: Changelog 4.1.1 (#36029)

https://github.com/elementor/elementorasafdlMay 27, 2026Fixed in 4.1.1via release-tag
commit
2 files changed · +12 −0
  • changelog.txt+6 −0 modified
    @@ -1,5 +1,11 @@
 == Changelog ==
 
+= 4.1.1 - 2026-05-27 =
+
+* Security Fix: Improved code security enforcement in content handling
+* Security Fix: Improved code security enforcement in template handling
+* Fix: Hiding one filter prevents other filters from being applied - Atomic Editor
+
 = 4.1.0 - 2026-05-26 =
 
 * New: Introducing the Design System panel for managing Variables and Classes in one place - Atomic Editor
  • readme.txt+6 −0 modified
    @@ -355,6 +355,12 @@ You can also add a new language via [translate.wordpress.org](https://go.element
 
 == Changelog ==
 
+= 4.1.1 - 2026-05-27 =
+
+* Security Fix: Improved code security enforcement in content handling
+* Security Fix: Improved code security enforcement in template handling
+* Fix: Hiding one filter prevents other filters from being applied - Atomic Editor
+
 = 4.1.0 - 2026-05-26 =
 
 * New: Introducing the Design System panel for managing Variables and Classes in one place - Atomic Editor

Vulnerability mechanics

Root cause

"The vulnerability stems from missing authorization checks in how the Elementor Website Builder handles content and template access."

Attack vector

An attacker with low-privilege access can exploit this vulnerability by sending specially crafted requests to the application. This bypasses the intended access control mechanisms, allowing unauthorized actions. The vulnerability is present in versions up to and including 4.1.0 [patch_id=4494233].

Affected code

The vulnerability is related to the handling of content and templates within the Elementor Website Builder. The security fixes implemented in version 4.1.1 specifically target these areas to enforce proper access control [patch_id=4494233].

What the fix does

The patch, released in version 4.1.1, addresses the vulnerability by improving code security enforcement in content and template handling [patch_id=4494233]. This enhancement ensures that access controls are correctly applied, preventing unauthorized users from exploiting the misconfiguration.

Preconditions

  • authThe attacker must have low-privilege access to the application.

Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.