Jeg Kit exposes configuration and possible API credentials to Contributors
Jeg Kit for Elementor through 3.1.1 runs class/dashboard/class-dashboard.php::enqueue_scripts() on the post.php administration screen for users who can edit posts. It injects JkitDashboardOption into the page without an additional capability check, allowing a Contributor-or-higher user to inspect plugin names, versions, paths and activation states; WordPress, PHP, URL and server-capability details; and jkit_user_data values that may include a Mailchimp API key. The attacker reads the inline JavaScript from the page source after logging in.
- Component
- Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
- Plugin slug
jeg-elementor-kit- Affected
- <= 3.1.1
- Safe version
3.1.2- Published
- Aug 01, 2026
This CVE was published Aug 01, 2026 and is one of 21 known issues for this plugin.
Update, patch or deactivate.
Update Jeg Kit for Elementor to 3.1.2 or later. Review Contributor access and post.php requests, rotate Mailchimp or other third-party credentials present in jkit_user_data, and treat the disclosed plugin and environment inventory as useful reconnaissance for follow-on attacks.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N