CVE-2026-49782

Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization

mediumMissing Authorization

4.3

CVSS Score

4.3

CVSS Score

medium

Severity

4.1.1

Patched in

Time to patch

Description

The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.1.0. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

None

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=4.1.0

PublishedJune 2, 2026

Last updatedJune 8, 2026

Affected pluginelementor

What Changed in the Fix

Changes introduced in v4.1.1

Loading patch diff...

Source Code

WordPress.org SVN

Vulnerable v4.1.0

Browse source Download .zip

Patched v4.1.1

Browse source Download .zip

Research Plan

Unverified

# Research Plan: CVE-2026-49782 - Elementor Missing Authorization in AJAX Handlers ## 1. Vulnerability Summary The **Elementor Website Builder** plugin for WordPress (versions <= 4.1.0) contains a missing authorization vulnerability within its centralized AJAX dispatching system. The plugin registe…

Show full research plan

Research Plan: CVE-2026-49782 - Elementor Missing Authorization in AJAX Handlers

1. Vulnerability Summary

The Elementor Website Builder plugin for WordPress (versions <= 4.1.0) contains a missing authorization vulnerability within its centralized AJAX dispatching system. The plugin registers a primary AJAX action, elementor_ajax, which acts as a gateway for dozens of internal sub-actions (commands). While some commands correctly verify user capabilities, several sub-actions (likely related to the newly introduced AI Layout and Template Kit features) fail to validate if the authenticated user has sufficient permissions (e.g., edit_others_posts or manage_options) before executing their logic. This allows a user with Contributor level access to perform actions they are not authorized for, such as manipulating layout data or accessing administrative content.

2. Attack Vector Analysis

Vulnerable Endpoint: POST /wp-admin/admin-ajax.php
AJAX Action: elementor_ajax
Vulnerable Parameter: actions (a JSON-encoded string containing a map of sub-commands and their data).
Authentication Requirement: Authenticated user with at least Contributor role.
Preconditions: An attacker must obtain a valid AJAX nonce, which is typically localized in the WordPress admin dashboard for all logged-in users.

3. Code Flow (Inferred)

Registration: The plugin registers the handler via add_action( 'wp_ajax_elementor_ajax', [ $ajax_manager, 'handle_ajax_request' ] );.
Parsing: The handle_ajax_request method in the Ajax manager module parses the actions JSON payload.
Command Execution: It iterates through the requested actions and instantiates specific command classes (e.g., related to AI Layout or Document actions).
Vulnerability: The specific command handler (e.g., get_remote_template_content or save_builder_data) lacks a current_user_can() check or relies on an insufficient capability check that allows Contributors to modify or retrieve data they do not own.

4. Nonce Acquisition Strategy

Elementor nonces are exposed via localized JavaScript objects in the WordPress admin. Based on common Elementor architecture:

JavaScript Variable: window.elementorCommon.config.ajax.nonce
Acquisition Method:
1. Log in as a Contributor.
2. Navigate to any page in the WordPress admin dashboard (e.g., /wp-admin/profile.php).
3. Execute the following via browser_eval:
```
window.elementorCommon?.config?.ajax?.nonce || window.elementorConfig?.ajax?.nonce
```
Alternative: If the script is only loaded on specific pages, navigate to /wp-admin/admin.php?page=elementor-app (the Elementor App Loader, referenced in assets/js/app-loader.strings.js).

5. Exploitation Strategy

We will attempt to perform an unauthorized action using the elementor_ajax action. A common target for "Integrity: Low" (CVSS 4.3) is retrieving or slightly modifying layout content.

HTTP Request (using `http_request` tool)

Method: POST
URL: http://localhost:8080/wp-admin/admin-ajax.php
Headers: Content-Type: application/x-www-form-urlencoded

Body:

action=elementor_ajax
&_nonce=[EXTRACTED_NONCE]
&actions={"exploit_cmd":{"action":"get_remote_template_content","data":{"editor_post_id":1,"template_id":"12345"}}}

(Note: Replace editor_post_id with an existing Post ID and template_id with a valid or placeholder ID).

Alternative Sub-Actions (based on provided `.strings.js` files):

If get_remote_template_content is patched, try:

AI Layout Generation: {"cmd":{"action":"ai_layout_get_content","data":{...}}} (referenced by ai-layout.strings.js).
Delete Content: {"cmd":{"action":"delete_all_content","data":{"post_id":1}}} (referenced by editor-document.strings.js string: "Attention: We are going to DELETE ALL CONTENT from this page.").

6. Test Data Setup

Users:
- Administrator: admin / password
- Contributor: attacker / password
Content:
- Create a Page (Post ID 1) as the Administrator and edit it with Elementor.
Plugin:
- Ensure Elementor <= 4.1.0 is installed and activated.

7. Expected Results

Vulnerable: The server returns a 200 OK with a JSON object containing the result of the sub-action (e.g., "success": true and the template content or confirmation of deletion).
Patched: The server returns a 200 OK but the JSON internal response indicates a failure, such as {"success": false, "data": "permission_denied"} or a 403 Forbidden status.

8. Verification Steps

Check the HTTP response body for the success: true flag inside the specific action's response.
Database Check: Use WP-CLI to verify if the unauthorized action took effect:
```
wp post get 1 --field=post_content
```
If the action was delete_all_content, the content should be empty or reverted.

9. Alternative Approaches

If the elementor_ajax action requires a specific editor state, try exploiting the REST API routes if they exist for the AI features:

Endpoint: /wp-json/elementor/v1/ai/get-layout
Method: POST
Auth: Include the X-WP-Nonce (retrieved via window.wpApiSettings.nonce).

Research Findings

Static analysis — not yet PoC-verified

Summary

The Elementor Website Builder plugin for WordPress (versions up to 4.1.0) fails to properly validate user capabilities within its centralized AJAX dispatching system. This allows authenticated users with Contributor-level permissions to execute restricted sub-actions, potentially leading to unauthorized data retrieval or content modification.

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/elementor/4.1.0/assets/js/ai-layout.strings.js /home/deploy/wp-safety.org/data/plugin-versions/elementor/4.1.1/assets/js/ai-layout.strings.js
--- /home/deploy/wp-safety.org/data/plugin-versions/elementor/4.1.0/assets/js/ai-layout.strings.js	2026-05-26 08:54:34.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/elementor/4.1.1/assets/js/ai-layout.strings.js	2026-05-27 11:26:54.000000000 +0000
@@ -231,61 +231,6 @@
 __( 'blocks', 'elementor' );
 __( 'Loading', 'elementor' );
 __( 'Show prompt history', 'elementor' );
-__( 'Cancel', 'elementor' );
-__( 'Yes, leave', 'elementor' );
-__( 'Preview unavailable', 'elementor' );
-__( 'Hero section on [topic] with heading, text, buttons on the right, and an image on the left', 'elementor.com' ) },
-	// Translators: [Topic] is a placeholder for the user - please translate it as well
-	{ text: __( 'About Us section on [topic] with heading, text, and big image below', 'elementor.com' ) },
-	{ text: __( 'Team section with four image boxes showcasing team members', 'elementor.com' ) },
-	// Translators: [Topic] is a placeholder for the user - please translate it as well
-	{ text: __( 'FAQ section with a toggle widget showcasing FAQs about [topic]', 'elementor.com' ) },
-	{ text: __( 'Gallery section with a carousel displaying three images at once', 'elementor.com' ) },
-	// Translators: [Topic] is a placeholder for the user - please translate it as well
-	{ text: __( 'Contact section with a form for [topic]', 'elementor.com' ) },
-	{ text: __( 'Client section featuring companies\' logos', 'elementor.com' ) },
-	// Translators: [Topic] is a placeholder for the user - please translate it as well
-	{ text: __( 'Testimonial section with testimonials, each featuring a star rating and an image', 'elementor.com' ) },
-	// Translators: [Topic] is a placeholder for the user - please translate it as well
-	{ text: __( 'Service section about [topic], showcasing four services with buttons', 'elementor.com' ) },
-	// Translators: [Topic] is a placeholder for the user - please translate it as well
-	{ text: __( 'Stats section with counters displaying data about [topic]', 'elementor.com' ) },
-	{ text: __( 'Quote section with colored background, featuring a centered quote', 'elementor.com' ) },
-	// Translators: [Topic] is a placeholder for the user - please translate it as well
-	{ text: __( 'Pricing section for [topic] with a pricing list', 'elementor.com' ) },
-	// Translators: [Topic] is a placeholder for the user - please translate it as well
-	{ text: __( 'Subscribe section featuring a simple email form, inviting users to stay informed on [topic]', 'elementor.com' ) },
-] );
-
-const IconButtonWithTooltip = ( { tooltip, ...props } ) => (
-	<Tooltip title={ tooltip }>
-		<Box component="span" sx={ { cursor: props.disabled ? 'default' : 'pointer' } }>
-			<IconButton { ...props } />
-		</Box>
-	</Tooltip>
-);
-
-IconButtonWithTooltip.propTypes = {
-	tooltip: PropTypes.string,
-	disabled: PropTypes.bool,
-};
-
-const BackButton = ( props ) => (
-	<IconButtonWithTooltip size="small" color="secondary" tooltip={ __( 'Back to results', 'elementor' );
-__( 'Edit prompt', 'elementor' );
-__( 'Generate', 'elementor' );
-__( "Press '/' for suggested prompts or describe the layout you want to create", 'elementor' );
-__( 'Suggested Prompts', 'elementor' );
-__( 'Upgrade your plan for best results.', 'elementor' );
-__( 'You won’t be able to use layouts with Elementor Pro widgets until you do.', 'elementor' );
-__( 'Go Pro', 'elementor' );
-__( 'Go Pro', 'elementor' );
-__( 'Pro', 'elementor' );
-__( "This result includes an Elementor Pro widget that's not available with your current plan. Upgrade to use all the widgets in this result.", 'elementor' );
-__( 'AI', 'elementor' );
-__( 'Beta', 'elementor' );
-__( 'Reference a website', 'elementor' );
-__( 'Create variations from Template Library', 'elementor' );
 __( 'None', 'elementor' );
 __( 'Photographic', 'elementor' );
 __( 'None', 'elementor' );
@@ -366,6 +311,61 @@
 __( 'Generate again', 'elementor' );
 __( 'Enhance prompt', 'elementor' );
 __( 'Back', 'elementor' );
+__( 'Cancel', 'elementor' );
+__( 'Yes, leave', 'elementor' );
+__( 'Preview unavailable', 'elementor' );
+__( 'Hero section on [topic] with heading, text, buttons on the right, and an image on the left', 'elementor.com' ) },
+	// Translators: [Topic] is a placeholder for the user - please translate it as well
+	{ text: __( 'About Us section on [topic] with heading, text, and big image below', 'elementor.com' ) },
+	{ text: __( 'Team section with four image boxes showcasing team members', 'elementor.com' ) },
+	// Translators: [Topic] is a placeholder for the user - please translate it as well
+	{ text: __( 'FAQ section with a toggle widget showcasing FAQs about [topic]', 'elementor.com' ) },
+	{ text: __( 'Gallery section with a carousel displaying three images at once', 'elementor.com' ) },
+	// Translators: [Topic] is a placeholder for the user - please translate it as well
+	{ text: __( 'Contact section with a form for [topic]', 'elementor.com' ) },
+	{ text: __( 'Client section featuring companies\' logos', 'elementor.com' ) },
+	// Translators: [Topic] is a placeholder for the user - please translate it as well
+	{ text: __( 'Testimonial section with testimonials, each featuring a star rating and an image', 'elementor.com' ) },
+	// Translators: [Topic] is a placeholder for the user - please translate it as well
+	{ text: __( 'Service section about [topic], showcasing four services with buttons', 'elementor.com' ) },
+	// Translators: [Topic] is a placeholder for the user - please translate it as well
+	{ text: __( 'Stats section with counters displaying data about [topic]', 'elementor.com' ) },
+	{ text: __( 'Quote section with colored background, featuring a centered quote', 'elementor.com' ) },
+	// Translators: [Topic] is a placeholder for the user - please translate it as well
+	{ text: __( 'Pricing section for [topic] with a pricing list', 'elementor.com' ) },
+	// Translators: [Topic] is a placeholder for the user - please translate it as well
+	{ text: __( 'Subscribe section featuring a simple email form, inviting users to stay informed on [topic]', 'elementor.com' ) },
+] );
+
+const IconButtonWithTooltip = ( { tooltip, ...props } ) => (
+	<Tooltip title={ tooltip }>
+		<Box component="span" sx={ { cursor: props.disabled ? 'default' : 'pointer' } }>
+			<IconButton { ...props } />
+		</Box>
+	</Tooltip>
+);
+
+IconButtonWithTooltip.propTypes = {
+	tooltip: PropTypes.string,
+	disabled: PropTypes.bool,
+};
+
+const BackButton = ( props ) => (
+	<IconButtonWithTooltip size="small" color="secondary" tooltip={ __( 'Back to results', 'elementor' );
+__( 'Edit prompt', 'elementor' );
+__( 'Generate', 'elementor' );
+__( "Press '/' for suggested prompts or describe the layout you want to create", 'elementor' );
+__( 'Suggested Prompts', 'elementor' );
+__( 'Upgrade your plan for best results.', 'elementor' );
+__( 'You won’t be able to use layouts with Elementor Pro widgets until you do.', 'elementor' );
+__( 'Go Pro', 'elementor' );
+__( 'Go Pro', 'elementor' );
+__( 'Pro', 'elementor' );
+__( "This result includes an Elementor Pro widget that's not available with your current plan. Upgrade to use all the widgets in this result.", 'elementor' );
+__( 'AI', 'elementor' );
+__( 'Beta', 'elementor' );
+__( 'Reference a website', 'elementor' );
+__( 'Create variations from Template Library', 'elementor' );

Exploit Outline

The exploit targets the 'elementor_ajax' endpoint, which manages internal plugin commands. An attacker with Contributor-level access must first obtain a valid AJAX nonce, typically available via the 'elementorCommon.config.ajax.nonce' global variable in the admin dashboard. The attacker then sends a POST request to '/wp-admin/admin-ajax.php' with the 'actions' parameter containing a JSON-encoded payload. This payload specifies a restricted sub-command (e.g., 'delete_all_content' or 'get_remote_template_content') and its associated data (like a target Post ID). Because the plugin's server-side logic fails to verify if the requesting user has the required capabilities for that specific sub-action, the command is executed with administrative privileges.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd9ae0d-aa3a-4fb3-93b8-0e25bd01e162?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database

Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization

Description

CVSS Vector Breakdown

Technical Details

What Changed in the Fix

Source Code

Research Plan: CVE-2026-49782 - Elementor Missing Authorization in AJAX Handlers

1. Vulnerability Summary

2. Attack Vector Analysis

3. Code Flow (Inferred)

4. Nonce Acquisition Strategy

5. Exploitation Strategy

HTTP Request (using http_request tool)

Alternative Sub-Actions (based on provided .strings.js files):

6. Test Data Setup

7. Expected Results

8. Verification Steps

9. Alternative Approaches

Summary

Security Fix

Exploit Outline

Check if your site is affected.

HTTP Request (using `http_request` tool)

Alternative Sub-Actions (based on provided `.strings.js` files):