CVE-2026-109890

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Unauthenticated remote attackers can read sensitive data by exploiting broken access control checks. They only need network access to the target WordPress site.

Root cause

The plugin fails to perform authorization checks, allowing unauthorized users to trigger restricted functionality and view protected data.

Affected systems

LeapWorx Premium Addons for Elementor through 4.11.110

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade Premium Addons for Elementor to a version newer than 4.11.110. If an update is not yet available, deactivate the plugin until a patch is released.

shell

$ wp plugin update premium-addons-for-elementor

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.

References

https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-110-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-109890