[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNP__fOUBmLut1mo0IJ6-6rTB9TZqiEyQZJ-5YIaiw-4":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":25,"research_verified":26,"research_rounds_completed":27,"research_plan":28,"research_summary":29,"research_vulnerable_code":30,"research_fix_diff":31,"research_exploit_outline":32,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":26,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":26,"source_links":36},"CVE-2026-11600","envos-templates-widgets-for-elementor-and-woocommerce-missing-authorization-to-authenticated-author-private-content-disc","Envo's Templates & Widgets for Elementor and WooCommerce \u003C= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting","The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) widget's template rendering in versions up to, and including, 1.4.26. The render() method of the Tabs widget passes a user-controlled template\u002Fpost ID directly to Elementor's get_builder_content_for_display() without verifying the referenced post's status (published\u002Fprivate\u002Fdraft) or the visitor's authorization to view it. This makes it possible for authenticated attackers, with Author-level access and above, to disclose the contents of private Elementor-driven pages and templates to anonymous visitors by configuring an Envo Tabs widget on a public post to reference the private content's ID (which can be supplied by editing the underlying Elementor widget JSON via the Elementor editor REST API).","envo-elementor-for-woocommerce",null,"\u003C=1.4.26","1.4.27","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Missing Authorization","2026-07-01 00:00:00","2026-07-02 05:35:01",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F26100f1f-3224-486c-b4f9-7086d405a883?source=api-prod",1,[22,23,24],"elementor-templates-widgets-woocommerce.php","modules\u002Ftabs\u002Fwidgets\u002Ftabs.php","readme.txt","researched",false,3,"# Exploitation Research Plan: CVE-2026-11600\n\n## 1. Vulnerability Summary\nThe **Envo's Templates & Widgets for Elementor and WooCommerce** plugin (\u003C= 1.4.26) is vulnerable to **Missing Authorization** in the `Envo Tabs` and `Off Canvas` widgets. The widget's `render()` method takes a post\u002Ftemplate ID from the widget's settings (configured in the Elementor editor) and passes it directly to Elementor's `get_builder_content_for_display()` function. \n\nCrucially, the plugin fails to verify if the post ID being rendered is \"Published\" or if the current visitor has permission to view it. This allows an authenticated user with \"Author\" privileges (who can use Elementor to edit their own posts) to inject the ID of a \"Private\" or \"Draft\" post\u002Ftemplate belonging to another user (e.g., an Administrator). When the Author's post is viewed by an anonymous visitor, the plugin renders the sensitive content of the private post.\n\n## 2. Attack Vector Analysis\n- **Entry Point**: The `render()` method of the `ETWWElementor\\Modules\\Tabs\\Widgets\\Tabs` class (and similarly the Off Canvas widget).\n- **Vulnerable Parameter**: The `templates` setting within the Elementor widget JSON data.\n- **Authentication**: Requires **Author-level** access (or any role capable of using the Elementor Editor).\n- **Payload**: A JSON object representing an Elementor widget configuration where the `templates` setting is set to the ID of a private post\u002Ftemplate.\n- **Preconditions**: \n    1. A private post or Elementor template containing sensitive data must exist (target ID).\n    2. The attacker must have permissions to create\u002Fedit a post with Elementor.\n\n## 3. Code Flow\n1. **Configuration Phase (Authenticated Author)**:\n   - The Author edits a post using Elementor.\n   - The Author adds an `etww-tabs` widget.\n   - The Author saves the post. The configuration is stored in the `_elementor_data` post meta.\n   - Using the WordPress REST API or Elementor Editor API, the Author modifies the `templates` value in the JSON payload to point to a private post ID (e.g., ID `1337`).\n\n2. **Rendering Phase (Anonymous Visitor)**:\n   - A visitor requests the URL of the Author's post.\n   - WordPress initializes Elementor, which calls `ETWWElementor\\Modules\\Tabs\\Widgets\\Tabs::render()`.\n   - `render()` retrieves settings via `$this->get_settings_for_display()`.\n   - The code (inferred from patch) executes: \n     `echo Plugin::$instance->frontend->get_builder_content_for_display( $settings['templates'] );`\n   - `get_builder_content_for_display()` fetches the post by ID and renders its content regardless of status (Private\u002FDraft) because the authorization check is missing in the caller (`Tabs` widget).\n\n## 4. Nonce Acquisition Strategy\nThe exploit involves two stages: one authenticated (to set up the payload) and one unauthenticated (to trigger the disclosure).\n\n### Authenticated Stage (Author)\nTo save the malicious widget configuration, the Author needs a REST API nonce.\n1. **Navigate to the Post Editor**: Access the Elementor editor for a post the Author owns.\n2. **Extract Nonce**: The nonce for the WordPress REST API is typically localized as `wpApiSettings.nonce`.\n3. **JS Execution**: \n   `browser_eval(\"wpApiSettings.nonce\")`\n\n## 5. Exploitation Strategy\n\n### Step 1: Discover Target ID\nThe attacker needs the ID of the private post. In a real-world scenario, this might be brute-forced or found via other info leaks. For this PoC, we will assume the ID is known after setup.\n\n### Step 2: Inject Malicious Widget (Authenticated)\nAs the **Author**, send a request to update the post's Elementor data.\n- **Endpoint**: `POST \u002Fwp-json\u002Fwp\u002Fv2\u002Fposts\u002F{POST_ID}` (Standard WP REST API) or `POST \u002Fwp-json\u002Felementor\u002Fv1\u002Feditor-data`\n- **Method**: `POST`\n- **Headers**: \n  - `X-WP-Nonce: [NONCE]`\n  - `Content-Type: application\u002Fjson`\n- **Payload**:\n  The `_elementor_data` meta field must contain a JSON string. The crucial part is the `etww-tabs` widget:\n  ```json\n  [\n    {\n      \"id\": \"random_id\",\n      \"elType\": \"widget\",\n      \"widgetType\": \"etww-tabs\",\n      \"settings\": {\n        \"tabs\": [\n          {\n            \"tab_title\": \"Exploit Tab\",\n            \"source\": \"template\",\n            \"templates\": \"TARGET_PRIVATE_POST_ID\"\n          }\n        ]\n      }\n    }\n  ]\n  ```\n\n### Step 3: Disclosure (Unauthenticated)\n- **Endpoint**: `GET \u002F?p={AUTHOR_POST_ID}`\n- **Action**: Access the post as an anonymous user.\n- **Result**: The content of the private post (TARGET_PRIVATE_POST_ID) will be rendered within the Tab content.\n\n## 6. Test Data Setup\n1. **Administrator User**:\n   - Create a private post (ID `X`) with the content: `\"SECRET_DATA_INTERNAL_ONLY\"`.\n   - Ensure the post status is `private`.\n2. **Author User**:\n   - Create a user with the `Author` role.\n   - Create a public post (ID `Y`) and enable Elementor for it.\n3. **Plugin Config**:\n   - Ensure \"Envo's Templates & Widgets\" is active.\n\n## 7. Expected Results\n- When accessing `GET \u002F?p=Y` (the Author's post) as an **anonymous** user, the string `\"SECRET_DATA_INTERNAL_ONLY\"` should be visible in the HTML response inside the `etww-tabs` container.\n- Normally, this content would be inaccessible to anonymous users and Authors.\n\n## 8. Verification Steps\n1. **Check Status**: Use `wp post get X --field=post_status` to confirm the target post is indeed `private`.\n2. **Check Response**: Search the HTML of the Author's post for the secret string:\n   `http_request(\"GET\", \"http:\u002F\u002Flocalhost:8080\u002F?p=Y\")` -> Verify presence of `\"SECRET_DATA_INTERNAL_ONLY\"`.\n\n## 9. Alternative Approaches\nIf updating via REST API is blocked, the attacker can use `admin-ajax.php` with the action `elementor_ajax` to save editor data:\n- **Action**: `elementor_ajax`\n- **Data**: `actions={\"save_builder\":{\"action\":\"save_builder\",\"data\":{\"status\":\"publish\",\"elements\":[...]}}}`\n- **Nonce**: Required from `window.elementorConfig.api_nonce`.\n\nIf the `Tabs` widget is not available, try the `etww-off-canvas` widget, as the description indicates it is also vulnerable. The setting name might be `template_id` or `templates` (check `register_controls` in `modules\u002Foff-canvas\u002Fwidgets\u002Foff-canvas.php` if available).","The Envo Tabs widget in Envo's Templates & Widgets for Elementor and WooCommerce fails to verify the status or permissions of templates it renders via post IDs. This allows authenticated users with Author-level access to inject private post IDs into the widget settings, resulting in the disclosure of sensitive private content to anonymous visitors.","\u002F\u002F modules\u002Ftabs\u002Fwidgets\u002Ftabs.php line 1267\n                        } else if ('template' == $item['source'] && ('0' != $item['templates'] && !empty($item['templates']))) {\n                            echo Plugin::instance()->frontend->get_builder_content_for_display($item['templates']);\n                        }","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fenvo-elementor-for-woocommerce\u002F1.4.26\u002Fmodules\u002Ftabs\u002Fwidgets\u002Ftabs.php\t2026-05-27 06:33:38.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fenvo-elementor-for-woocommerce\u002F1.4.27\u002Fmodules\u002Ftabs\u002Fwidgets\u002Ftabs.php\t2026-06-19 10:52:20.000000000 +0000\n@@ -1265,7 +1265,9 @@\n                         if ('custom' == $item['source'] && !empty($item['tab_content'])) {\n                             echo $this->parse_text_editor($item['tab_content']);\n                         } else if ('template' == $item['source'] && ('0' != $item['templates'] && !empty($item['templates']))) {\n-                            echo Plugin::instance()->frontend->get_builder_content_for_display($item['templates']);\n+\t\t\t\t\t\t\tif (get_post_status($item['templates']) === 'publish') {\n+\t\t\t\t\t\t\t\techo Plugin::instance()->frontend->get_builder_content_for_display($item['templates']);\n+\t\t\t\t\t\t\t}\n                         }\n                         ?>\n                     \u003C\u002Fdiv>","The exploit is executed by an authenticated attacker with Author-level privileges or higher. \n\n1. The attacker identifies the ID of a private post or Elementor template containing sensitive data.\n2. The attacker creates or edits a post they own using the Elementor editor and adds the 'Envo Tabs' (etww-tabs) widget.\n3. Using the WordPress REST API (targeting the post's meta) or the Elementor Editor AJAX API (action: 'elementor_ajax'), the attacker manually updates the widget configuration JSON in the '_elementor_data' field. They set the 'source' to 'template' and the 'templates' parameter to the ID of the target private post.\n4. Once the post is saved, the attacker or any anonymous visitor navigates to the public URL of the Author's post. \n5. The 'render()' method in the Tabs widget fetches the private post content via 'get_builder_content_for_display()' and displays it on the page because it lacks a check for 'publish' status or user authorization.","gemini-3-flash-preview","2026-07-25 12:15:59","2026-07-25 12:16:22",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","1.4.26","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fenvo-elementor-for-woocommerce\u002Ftags\u002F1.4.26","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fenvo-elementor-for-woocommerce.1.4.26.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fenvo-elementor-for-woocommerce\u002Ftags\u002F1.4.27","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fenvo-elementor-for-woocommerce.1.4.27.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fenvo-elementor-for-woocommerce\u002Ftags"]