CVE-2026-115949: WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/better-post-filter-widgets-for-elementorto a version that resolves this vulnerability.Fixed in 1.9.2
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation is network-accessible, requires no user interaction, and has low attack complexity.
What is the likely impact if the vulnerability is exploited?
The reported impact is high confidentiality impact, with no integrity or availability impact listed. The issue is classified as broken access control involving incorrectly configured access-control security levels.
Which versions are affected?
Better Post & Filter Widgets for Elementor versions through 1.9.1 are affected. The provided data does not identify a fixed version.