Elementor Website Builder – more than just a page builder: Sensitive information exposure
Elementor Website Builder – more than just a page builder is affected by sensitive information exposure. Exploitation requires at least contributor-level access. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 3.35.7.
- Component
- Elementor Website Builder – more than just a page builder
- Plugin slug
elementor-website-builder- Affected
- <= 3.35.7
- Safe version
> 3.35.7- Published
- Mar 26, 2026
This CVE was published Mar 26, 2026 and is one of 2 known issues for this plugin.
Patch or disable the affected component.
Update Elementor Website Builder – more than just a page builder to a release after 3.35.7, or disable and remove it until a fixed version is available.
Technical description
The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N