CVE-2026-91047: ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter

Q: Who is exposed to this issue?

WordPress sites using ElementsReady Addons for Elementor version 6.7.2 or earlier are exposed if they offer protected WooCommerce products with downloadable files. Any unauthenticated remote user can attempt to retrieve those files.

Q: What does an attacker need to exploit it?

No account, payment, or user interaction is required. The vulnerability is reachable over the network and uses the downloadtype parameter to bypass the payment restriction.

Q: What is the impact if exploitation succeeds?

An attacker can obtain paid downloadable files for WooCommerce products without completing payment. The provided CVSS vector indicates confidentiality impact only; integrity and availability impacts are not identified.

Published Oct 19, 2026

Updated

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.

Affected Software

1 affected component

ElementsReady ElementsReady Addons for Elementor<=6.7.2

Event History

Oct 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using ElementsReady Addons for Elementor version 6.7.2 or earlier are exposed if they offer protected WooCommerce products with downloadable files. Any unauthenticated remote user can attempt to retrieve those files.

What does an attacker need to exploit it?

No account, payment, or user interaction is required. The vulnerability is reachable over the network and uses the downloadtype parameter to bypass the payment restriction.

What is the impact if exploitation succeeds?

An attacker can obtain paid downloadable files for WooCommerce products without completing payment. The provided CVSS vector indicates confidentiality impact only; integrity and availability impacts are not identified.

CVE-2026-91047: ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact if exploitation succeeds?