[ CVE-2026-91046 · Published 19 Oct 2026 ]
Vulnerability in Unknown ElementsReady Addons for Elementor
CVSS 4.3
EPSS <1%No fix listed yet
[ Description ]Official description
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.