Essential Addons Product Compare exposes unpublished WooCommerce products
Essential Addons for Elementor - Lite before 6.6.10 exposes unpublished WooCommerce product data through the public eael_product_grid AJAX action when a published Product Grid widget has Compare enabled. An anonymous attacker can scrape the widget's eael_product_grid nonce and page_id and widget_id values from public HTML, then submit an attacker-selected product_ids JSON array to /wp-admin/admin-ajax.php. The compare path passes each ID through static_get_products_list() to wc_get_product() without checking product status, visibility, password protection, or caller authorization, disclosing the title, current price, and SKU of draft, pending, and private products. Version 6.6.10 adds security checks to the Woo Product Compare feature.
- Component
- Essential Addons for Elementor
- Plugin slug
essential-addons-for-elementor- Affected
- < 6.6.10
- Safe version
6.6.10- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 35 known issues for this plugin.
Update, patch or deactivate.
Update Essential Addons for Elementor - Lite to 6.6.10 or later. Until updated, disable Compare on Product Grid widgets. Review requests with action=eael_product_grid for enumeration of product_ids and assess unpublished products for commercially sensitive titles, pricing, or SKUs.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N