CVE-2026-110509: Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler
Published Oct 28, 2026
·Updated
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.
Affected Software
1 affected component
WPDeveloper Essential Addons for Elementor<6.8.7
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Essential Addons for Elementorto a version that resolves this vulnerability.Fixed in 6.8.7
Event History
Oct 28, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness