CVE-2026-1206: Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the isallowedtoreadtemplate() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'templateid' supplied to the 'gettemplatedata' action of the 'elementorajax' endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1206?
The severity of CVE-2026-1206 is considered high due to the risk of sensitive information exposure.
How do I fix CVE-2026-1206?
To fix CVE-2026-1206, update the Elementor Website Builder plugin to version 3.35.8 or later.
What type of information is exposed in CVE-2026-1206?
CVE-2026-1206 allows authenticated users to improperly access sensitive information within Elementor templates.
Who is affected by CVE-2026-1206?
All users of Elementor Website Builder versions up to and including 3.35.7 are affected by CVE-2026-1206.
Is there a workaround for CVE-2026-1206?
There is no official workaround for CVE-2026-1206; updating to a patched version is recommended.