CVE-2026-103907: Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkitpostblock' and 'jegfindauthor' AJAX actions in versions up to, and including, 3.2.19. The 'wpajaxjkitpostblock' handler (registered generically for every element via wpajax{$elementid} in ElementsOptionAbstract::setuphook) returns the element's full option schema — including a freshly minted wpcreatenonce('jegfindauthor') — to any authenticated caller, and the 'wpajaxjegfindauthor' handler then runs a WPUserQuery with the attacker-supplied 'query' wrapped in '…' against searchcolumns that include useremail, echoing the ID and displayname of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. No interaction from another user is required.
What information can an attacker obtain?
An attacker can enumerate registered site users, obtaining matching user IDs and display names. They can also infer users' email addresses character by character through repeated substring searches.
Does exploitation require a special site configuration?
The affected AJAX handlers are registered by the plugin, and the issue is described as affecting versions up to and including 3.2.19. The provided data does not identify an additional configuration prerequisite.
How does the attacker obtain the nonce needed for the user search action?
The attacker can call the jkit_post_block AJAX handler, which returns an element's full option schema to authenticated callers. That schema includes a newly generated nonce for the jeg_find_author action.