CVE-2026-1206
Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.
| CWE | CWE-639 |
| Vendor | elemntor |
| Product | elementor website builder – more than just a page builder |
| Published | Mar 26, 2026 |
| Last Updated | Apr 8, 2026 |
Get instant alerts for elemntor elementor website builder – more than just a page builder
Be the first to know when new medium vulnerabilities affecting elemntor elementor website builder – more than just a page builder are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N