CVE-2026-4106: HT Mega < 3.0.7 – Unauthenticated PII Disclosure
The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4106?
CVE-2026-4106 is considered a high severity vulnerability due to the potential for unauthorized access to personally identifiable information (PII).
How do I fix CVE-2026-4106?
To fix CVE-2026-4106, update the HT Mega Addons for Elementor plugin to version 3.0.7 or later.
What types of PII are exposed in CVE-2026-4106?
CVE-2026-4106 exposes sensitive information including full name, city, state, and country of customers.
Who is affected by CVE-2026-4106?
Anyone using versions of the HT Mega Addons for Elementor plugin prior to 3.0.7 is affected by CVE-2026-4106.
Is authentication required to exploit CVE-2026-4106?
CVE-2026-4106 does not require authentication, making it particularly dangerous as it allows unauthenticated access to PII.