CVE-2026-91046: ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization

Q: Who can exploit this issue?

Any authenticated WordPress user with at least the Subscriber role can exploit it. An attacker does not need administrator privileges or user interaction.

Q: What can an attacker change?

An affected user can overwrite the plugin's stored settings, including stored API credentials and feature and template configuration. The provided data does not indicate that site-wide WordPress settings can be changed through this issue.

Q: Are unauthenticated visitors affected?

No. The CVSS vector specifies low privileges required (PR:L), and the description identifies Subscriber-level access or higher as the minimum access needed.

Published Oct 19, 2026

Updated

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.

Affected Software

1 affected component

ElementsReady ElementsReady Addons for Elementor<=6.7.2

Event History

Oct 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with at least the Subscriber role can exploit it. An attacker does not need administrator privileges or user interaction.

What can an attacker change?

An affected user can overwrite the plugin's stored settings, including stored API credentials and feature and template configuration. The provided data does not indicate that site-wide WordPress settings can be changed through this issue.

Are unauthenticated visitors affected?

No. The CVSS vector specifies low privileges required (PR:L), and the description identifies Subscriber-level access or higher as the minimum access needed.

CVE-2026-91046: ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Are unauthenticated visitors affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Are unauthenticated visitors affected?