CVE-2026-11905: Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keysconversionmap' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full postcontent and plaintext postpassword of private, draft, pending, and future posts belonging to any author, including Administrators and Editors.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with at least the Contributor role can exploit it. The attacker does not need interaction from another user.
What information could be exposed?
An attacker can extract the full post_content and plaintext post_password for private, draft, pending, and future posts. The affected posts can belong to any author, including Administrators and Editors.
Are published posts the only content at risk?
No. The issue specifically affects non-public workflow states, including private, draft, pending, and future posts.
Which Elementor versions are affected?
All versions up to and including Elementor Website Builder 4.2.3 are affected. The provided data does not identify a fixed version.