CVE-2026-4362: ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the LiveAction::reset() function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress init action and triggers when both post and action=elementor GET parameters are present, with no authentication or nonce verification. This makes it possible for unauthenticated attackers to overwrite the Elementor content (elementordata) of any elementskitwidget custom post type by visiting a specially crafted URL. The widget's custom designs, text, and configurations are permanently replaced with a blank template.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4362?
CVE-2026-4362 is classified as a medium severity vulnerability due to its potential for unauthorized data modification.
How do I fix CVE-2026-4362?
To resolve CVE-2026-4362, update the ElementsKit Elementor Addons plugin to version 3.8.3 or later, which contains the necessary security fixes.
What impact does CVE-2026-4362 have on my website?
CVE-2026-4362 allows unauthenticated users to overwrite widget content, potentially leading to data loss or unauthorized changes on your website.
Which versions of ElementsKit Elementor Addons are affected by CVE-2026-4362?
CVE-2026-4362 affects all versions of the ElementsKit Elementor Addons plugin up to and including version 3.8.2.
Who is the vendor responsible for CVE-2026-4362?
The vendor responsible for CVE-2026-4362 is ElementsKit, which develops the ElementsKit Elementor Addons for WordPress.