[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9g8WXyVoWp1vWb5L8zd3yIPsA9Sj8e8TG8D2qap_kOA":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":37},"CVE-2026-59511","exclusive-addons-for-elementor-unauthenticated-information-exposure","Exclusive Addons for Elementor \u003C= 2.7.9.9 - Unauthenticated Information Exposure","The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.9.9. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.","exclusive-addons-for-elementor",null,"\u003C=2.7.9.9","2.8.0","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Exposure of Sensitive Information to an Unauthorized Actor","2026-07-05 00:00:00","2026-07-08 19:51:03",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe0204832-4d1e-42af-8a1f-7610bed98111?source=api-prod",4,[22,23,24,25],"base.php","elements\u002Ffacebook-feed\u002Ffacebook-feed.php","exclusive-addons-elementor.php","readme.txt","researched",false,3,"# Exploitation Research Plan - CVE-2026-59511\n\n## 1. Vulnerability Summary\nThe **Exclusive Addons for Elementor** plugin (versions \u003C= 2.7.9.9) is vulnerable to **Unauthenticated Information Exposure**. The vulnerability stems from the plugin's failure to filter sensitive configuration data when passing widget settings to the frontend for features like AJAX pagination and \"Load More\" functionality. Specifically, widgets like the **Facebook Feed** include sensitive API credentials (e.g., `exad_facebook_access_token`) in the settings object, which is then exposed to unauthenticated visitors via localized JavaScript variables or AJAX responses.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `admin-ajax.php` (for AJAX-based exposure) or any public page containing the affected widget (for source-based exposure).\n- **Vulnerable Action:** `exad_ajax_pagination` and `exad_facebook_feed_action`.\n- **Authentication:** None (Unauthenticated).\n- **Preconditions:** A \"Facebook Feed\" widget must be configured on a published page with an Access Token.\n- **Severity:** Medium (CVSS 5.3) - Allows extraction of sensitive API tokens, which can be used to impersonate the site owner on third-party platforms (Facebook).\n\n## 3. Code Flow\n1.  **Registration:** In `base.php`, the plugin registers unauthenticated AJAX handlers:\n    ```php\n    add_action( 'wp_ajax_nopriv_ajax_pagination', [ __CLASS__, 'exad_ajax_pagination' ] );\n    add_action( 'wp_ajax_nopriv_exad_facebook_feed_action', [ $this, 'exad_facebook_feed_ajax' ] );\n    ```\n2.  **Control Definition:** In `elements\u002Ffacebook-feed\u002Ffacebook-feed.php`, the widget defines sensitive controls:\n    ```php\n    $this->add_control(\n        'exad_facebook_access_token',\n        [\n            'label' => esc_html__('Access Token', 'exclusive-addons-elementor' ),\n            'type' => Controls_Manager::TEXT,\n            'default' => 'EAAkn4TitXB...', \u002F\u002F Default token provided\n            \u002F\u002F ...\n        ]\n    );\n    ```\n3.  **Exposure (Frontend):** When the widget renders, it enqueues scripts. The plugin's core logic (likely in the `enqueue_scripts` method of `Base`) uses `wp_localize_script` to pass the entire `$settings` array of the widget to the frontend to facilitate AJAX \"Load More\" actions.\n4.  **Exposure (AJAX):** The `exad_ajax_pagination` function (in `base.php`) may return the settings object or require it to be sent back and forth. If the server retrieves and returns these settings without stripping `exad_facebook_access_token`, the information is exposed.\n\n## 4. Nonce Acquisition Strategy\nThe AJAX actions require a nonce for verification. This nonce is exposed in the frontend HTML.\n1.  **Identify Trigger:** The `exad-facebook-feed` widget or `Post Grid` widget triggers the script loading.\n2.  **Create Test Page:**\n    ```bash\n    wp post create --post_type=page --post_title=\"Exploit Test\" --post_status=publish --post_content='[exad-facebook-feed]'\n    ```\n3.  **Navigate and Extract:** Use `browser_navigate` to the new page.\n4.  **Extract via JS:** Use `browser_eval` to find the localized data. Based on the plugin structure, the variable is likely `exad_ajax_query_config` (inferred) or part of the `exclusive-addons-elementor` localization.\n    - Check: `browser_eval(\"window.exad_ajax_query_config\")`\n    - Check: `browser_eval(\"window.exad_facebook_feed_settings\")` (inferred)\n    - The nonce key is typically `nonce` or `ajax_nonce`.\n\n## 5. Exploitation Strategy\nThe goal is to retrieve the `exad_facebook_access_token` from an unauthenticated context.\n\n### Method A: Direct Page Source Extraction (Most Likely)\n1.  **Step 1:** Use `http_request` (GET) to fetch the URL of a page containing a Facebook Feed.\n2.  **Step 2:** Search the response body for the configuration object.\n    - Target string: `\"exad_facebook_access_token\":\"`\n3.  **Expected Payload Location:** Inside a `\u003Cscript>` tag with the ID `exclusive-addons-elementor-js-extra` or similar.\n\n### Method B: AJAX Response Extraction\n1.  **Step 1:** Obtain a valid nonce and the `post_id` from the target page.\n2.  **Step 2:** Craft a POST request to `admin-ajax.php`.\n    ```http\n    POST \u002Fwp-admin\u002Fadmin-ajax.php HTTP\u002F1.1\n    Content-Type: application\u002Fx-www-form-urlencoded\n\n    action=exad_ajax_pagination&id=[POST_ID]&nonce=[NONCE]&widget_id=[WIDGET_ID]\n    ```\n3.  **Step 3:** Analyze the JSON response for the presence of the `settings` block containing the access token.\n\n## 6. Test Data Setup\n1.  **Install Plugin:** Ensure `exclusive-addons-for-elementor` version `2.7.9.9` is active.\n2.  **Configure Widget:**\n    - Use `wp post create` to create a page.\n    - Manually or via CLI, update the `_elementor_data` post meta to include a `Facebook Feed` widget with a unique, identifiable string as the `exad_facebook_access_token`.\n    - Example identifying string: `SENSITIVE_TOKEN_1234567890`\n\n## 7. Expected Results\n- A successful exploit will return the string `SENSITIVE_TOKEN_1234567890` in an unauthenticated HTTP response.\n- This proves that an unauthorized actor can extract private API credentials configured by the site administrator.\n\n## 8. Verification Steps\n1.  **Check Database:**\n    ```bash\n    wp post meta get \u003CPOST_ID> _elementor_data\n    ```\n2.  **Compare:** Verify the string found in the HTTP response matches the token stored in the database.\n3.  **Validate Unauthenticated:** Ensure the `http_request` was sent without any session cookies.\n\n## 9. Alternative Approaches\nIf the Facebook token is not exposed, check other widgets that use external APIs, such as:\n- **Instagram Feed**\n- **Mailchimp**\n- **Google Maps**\n\nThe search pattern for any sensitive exposure in the JS localization is:\n```bash\ngrep -r \"wp_localize_script\" . -A 5 | grep \"settings\"\n```\nThis will identify where the plugin is passing widget settings to the frontend. Look for any call that passes an unfiltered `$settings` array.","The Exclusive Addons for Elementor plugin exposes sensitive API credentials, such as Facebook Access Tokens, by including them in widget settings passed to the frontend for AJAX pagination features. Unauthenticated attackers can retrieve these tokens from the page source where they are embedded in data attributes or localized JavaScript, enabling them to impersonate the site owner on third-party platforms.","\u002F\u002F elements\u002Ffacebook-feed\u002Ffacebook-feed.php\n\t\t$query_settings = [\n\t\t\t'widget_id' \t\t=> $id,\n\t\t\t'page_id' \t\t\t=> $page_id,\n\t\t\t'access_token' \t\t=> $access_token,\n\t\t\t'clear_cache' \t\t=> $settings['clear_cache'],\n\t\t\t'exad_facebook_sort_by' => $settings['exad_facebook_sort_by'],\n\t\t\t'post_limit' \t\t=> $settings['post_limit'],\n\n---\n\n\u002F\u002F base.php\n    public function exad_facebook_feed_ajax() {\n\n        $security = check_ajax_referer('exclusive_addons_nonce', 'security');\n\n        if ( true == $security && isset( $_POST['query_settings'] ) ) :\n            $settings = $_POST['query_settings'];\n            $loaded_item = $_POST['loaded_item'];","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Fbase.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.8.0\u002Fbase.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Fbase.php\t2026-06-24 01:11:06.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.8.0\u002Fbase.php\t2026-06-30 23:43:24.000000000 +0000\n@@ -10,6 +10,7 @@\n \n use Elementor\\Plugin;\n use ExclusiveAddons\\Elementor\\Exad_WPML_Element_Free_Compatibility;\n+use \\Elementor\\Utils;\n \n if ( ! defined( 'ABSPATH' ) ) {\n \texit;\n@@ -340,6 +341,11 @@\n \t\treturn $element;\n \t}\n \t\n+\tprotected function is_widget_id_valid( $widget_id ) {\n+\t\treturn preg_match( '\u002F^[a-zA-Z0-9]+$\u002F', $widget_id )\n+\t\t\t&& strlen( $widget_id ) === 7;\n+\t}\n+\t\n \n     \u002F**\n      * Facebook Feed ajax call\n@@ -351,16 +357,56 @@\n         $security = check_ajax_referer('exclusive_addons_nonce', 'security');\n \n         if ( true == $security && isset( $_POST['query_settings'] ) ) :\n-            $settings = $_POST['query_settings'];\n-            $loaded_item = $_POST['loaded_item'];\n-\n+\t\t\t$error_message = esc_html__( 'Something went wrong, please refresh the page.', 'exclusive-addons-elementor' );\n+\t\t\n+\t\t\tif ( ! is_array( $_POST[ 'query_settings' ] ) ) {\n+\t\t\t\t\n+\t\t\t\treturn $error_message;\n+\t\t\t}\n+\t\t\t\n+\t\t\t$settings = wp_kses_post_deep( wp_unslash( $_POST[ 'query_settings' ] ) );\n+            $loaded_item = wp_kses_post( wp_unslash( $_POST[ 'loaded_item' ] ) );\n+\t\t\t\n+\t\t\t$post_id = absint( $settings['post_id'] );\n+\t\t\t$widget_id = esc_attr( $settings['widget_id'] );\n+\t\t\t\n+\t\t\tif ( ! $post_id || ! $this->is_widget_id_valid( $widget_id ) ) {\n+\t\t\t\t\n+\t\t\t\treturn $error_message;\n+\t\t\t}\n+\t\t\t\n+\t\t\tPlugin::$instance->db->switch_to_post( $post_id );\n+\t\t\t$document = Plugin::$instance->documents->get( $post_id );\n+\t\t\t\n+\t\t\t\u002F\u002F Bail if not Elementor page.\n+\t\t\tif ( ! $document ) {\n+\t\t\t\t\n+\t\t\t\treturn $error_message;\n+\t\t\t}\n+\t\t\t\n+\t\t\t\u002F\u002F Setup $post_id as the WP global $post\n+\t\t\t$post = get_post( $post_id, OBJECT );\n+\t\t\tsetup_postdata( $post );\n+\t\t\t\n+\t\t\t$elements_data = $document->get_elements_data();\n+\t\t\t$widget_data = Utils::find_element_recursive( $elements_data, $widget_id );\n+\t\t\t$widget_instance = Plugin::$instance->elements_manager->create_element_instance( $widget_data );\n+\t\t\t$widget_settings = $widget_instance->get_settings_for_display();\n+\t\t\t\n+\t\t\tif ( ! isset( $widget_settings['exad_facebook_access_token'] ) ) {\n+\t\t\t\t\n+\t\t\t\treturn $error_message;\n+\t\t\t}\n+\t\t\t\n+\t\t\t$settings['access_token'] = $widget_settings['exad_facebook_access_token'];\n+\t\t\t\n             $exad_facebook_feed_cache = '_' . $settings['widget_id'] . '_facebook_cache';\n             $transient_key = $settings['exad_facebook_page_id'] . $exad_facebook_feed_cache;\n             $facebook_feed_data = get_transient($transient_key);\n \n             if ( false === $facebook_feed_data ) {\n                 $url_queries = 'fields=status_type,created_time,from,message,story,full_picture,permalink_url,attachments.limit(1){type,media_type,title,description,unshimmed_url},comments.summary(total_count),reactions.summary(total_count)';\n-                $url = \"https:\u002F\u002Fgraph.facebook.com\u002F{$settings['page_id']}\u002Fposts?{$url_queries}&access_token={$settings['access_token']}\";\n+                $url = \"https:\u002F\u002Fgraph.facebook.com\u002F{$settings['exad_facebook_page_id']}\u002Fposts?{$url_queries}&access_token={$settings['access_token']}\";\n                 $data = wp_remote_get( $url );\n                 $facebook_feed_data = json_decode( wp_remote_retrieve_body( $data ), true );\n                 set_transient( $transient_key, $facebook_feed_data, 0 );\n@@ -368,6 +414,17 @@\n             if ( $settings['clear_cache'] == 'yes' ) {\n                 delete_transient( $transient_key );\n             }\n+\t\t\t\n+\t\t\tif ( !empty( $facebook_feed_data ) && array_key_exists( 'error', $facebook_feed_data ) ) {\n+\t\t\t\t$messages['error'] = $facebook_feed_data['error']['message'];\n+\t\t\t}\n+\n+\t\t\tif ( !empty( $messages ) ) {\n+\t\t\t\tforeach ($messages as $key => $message) {\n+\t\t\t\t\tprintf('\u003Cdiv class=\"exad-facebook-error-message\">%1$s\u003C\u002Fdiv>', esc_html( $message ) );\n+\t\t\t\t}\n+\t\t\t\treturn;\n+\t\t\t}\n \n             switch ($settings['exad_facebook_sort_by']) {\n                 case 'old-posts':\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Felements\u002Ffacebook-feed\u002Ffacebook-feed.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.8.0\u002Felements\u002Ffacebook-feed\u002Ffacebook-feed.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.7.9.9\u002Felements\u002Ffacebook-feed\u002Ffacebook-feed.php\t2026-06-24 01:11:06.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fexclusive-addons-for-elementor\u002F2.8.0\u002Felements\u002Ffacebook-feed\u002Ffacebook-feed.php\t2026-06-30 23:43:24.000000000 +0000\n@@ -1489,6 +1490,8 @@\n \t\tif ( empty( $page_id ) || empty( $access_token ) ) {\n \t\t\treturn;\n \t\t}\n+\t\t\n+\t\t$current_post_id = get_the_ID();\n \n \t\t$this->add_render_attribute(\n \t\t\t'exad_facebook_feed_wrapper',\n@@ -1529,9 +1532,9 @@\n \n \n \t\t$query_settings = [\n+\t\t\t'post_id'\t\t\t=> $current_post_id,\n \t\t\t'widget_id' \t\t=> $id,\n-\t\t\t'page_id' \t\t\t=> $page_id,\n-\t\t\t'access_token' \t\t=> $access_token,\n+\t\t\t'exad_facebook_page_id' => $page_id,\n \t\t\t'clear_cache' \t\t=> $settings['clear_cache'],\n \t\t\t'exad_facebook_sort_by' => $settings['exad_facebook_sort_by'],\n \t\t\t'post_limit' \t\t=> $settings['post_limit'],","The exploit involves retrieving sensitive API credentials from the frontend of a WordPress site using the Exclusive Addons for Elementor plugin. \n\n1.  **Identify Target Page:** Locate a public page that utilizes the 'Facebook Feed' widget.\n2.  **Inspect Page Source:** Analyze the HTML source code of the identified page. The plugin embeds widget configuration data inside the `data-settings` attribute of the widget's wrapper element (e.g., `.exad-facebook-feed-wrapper`).\n3.  **Extract Credentials:** Locate the `exad_facebook_access_token` or `access_token` key within the JSON-encoded `data-settings` attribute value. This token can also often be found within localized JavaScript variables passed via `wp_localize_script` (e.g., in a script tag with the ID `exclusive-addons-elementor-js-extra`).\n4.  **Verification:** Use the extracted Access Token to make authenticated requests to the Facebook Graph API, confirming the exposure and severity. No authentication is required for the attacker to perform the extraction.","gemini-3-flash-preview","2026-07-25 09:40:03","2026-07-25 09:41:11",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","2.7.9.9","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fexclusive-addons-for-elementor\u002Ftags\u002F2.7.9.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fexclusive-addons-for-elementor.2.7.9.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fexclusive-addons-for-elementor\u002Ftags\u002F2.8.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fexclusive-addons-for-elementor.2.8.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fexclusive-addons-for-elementor\u002Ftags"]