CVE-2026-91047
ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.
| Vendor | unknown |
| Product | elementsready addons for elementor |
| Published | Oct 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown elementsready addons for elementor
Be the first to know when new unknown vulnerabilities affecting unknown elementsready addons for elementor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / ElementsReady Addons for Elementor
0 ≤ 6.7.2
References
Credits
ryan fabella WPScan