CVE-2026-1004: Elementor Plugin Information Disclosure

CVE-2026-1004 Overview

The Essential Addons for Elementor plugin for WordPress contains a Sensitive Information Exposure vulnerability in all versions up to and including 6.5.5. The vulnerability exists in the eael_product_quickview_popup function, which fails to properly validate product visibility and user permissions before returning WooCommerce product information.

This flaw allows unauthenticated attackers to retrieve detailed product information for WooCommerce products that have draft, pending, or private status—content that should normally be restricted to administrators and authorized users only.

Critical Impact
Unauthenticated attackers can access confidential WooCommerce product data including unpublished products, pricing strategies, and unreleased product details, potentially exposing sensitive business information.

Affected Products

Essential Addons for Elementor plugin for WordPress versions up to and including 6.5.5
WordPress sites using WooCommerce with the affected plugin versions
Sites utilizing the Quick View feature for product displays

Discovery Timeline

2026-01-16 - CVE-2026-1004 published to NVD
2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-1004

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization). The eael_product_quickview_popup function in the Ajax_Handler.php file processes AJAX requests to display WooCommerce product information in a quick view popup without properly verifying that the requested product should be accessible to the requesting user.

When an attacker sends a crafted AJAX request with a specific product ID, the function retrieves and returns the product data regardless of the product's publication status. This allows enumeration and exposure of products that are in draft, pending review, or marked as private—all of which should be hidden from public view.

The vulnerability is particularly concerning for e-commerce sites that:

Store upcoming product launches as drafts
Keep products with special pricing in private status
Have products pending review that contain sensitive information

Root Cause

The root cause is a missing authorization check in the eael_product_quickview_popup function. The vulnerable code directly retrieves product information using wc_get_product() without validating:

Whether the product exists and is visible to the public (is_visible())
Whether the requesting user has the appropriate capabilities to view non-published content
Whether the post status allows public access

The function processes any valid product ID without considering access control, leading to unauthorized information disclosure.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying a WordPress site using the Essential Addons for Elementor plugin with WooCommerce
Crafting AJAX requests to the eael_product_quickview_popup endpoint
Enumerating product IDs to discover draft, pending, or private products
Retrieving sensitive product information that should be restricted

The security patch addresses this by implementing proper visibility and permission checks:

php

 		wp_send_json_error();
 	}
 
-	// global $post, $product;
+	global $post, $product;
 	$product = wc_get_product( $product_id );
 	$post    = get_post( $product_id );
+
+	// SECURITY FIX: Verify product exists and is visible
+	if ( ! $product || ! $product->is_visible() ) {
+		wp_send_json_error( __( 'Product not found or not accessible', 'essential-addons-for-elementor-lite' ) );
+	}
+
+	// Also verify post status for non-admin users
+	$post = get_post( $product_id );
+	if ( ! current_user_can( 'edit_post', $product_id ) && $post->post_status !== 'publish' ) {
+		wp_send_json_error( __( 'Product not found or not accessible', 'essential-addons-for-elementor-lite' ) );
+	}
+
 	setup_postdata( $post );
 
 	$settings = $this->eael_get_widget_settings( $page_id, $widget_id );

Source: GitHub Commit Overview

Detection Methods for CVE-2026-1004

Indicators of Compromise

Unusual AJAX requests to wp-admin/admin-ajax.php with action parameter eael_product_quickview_popup
High volume of requests iterating through sequential product IDs
Requests for product IDs that return data for non-published products
Access logs showing enumeration patterns targeting product endpoints

Detection Strategies

Monitor web application logs for repeated AJAX requests to the eael_product_quickview_popup action
Implement rate limiting on AJAX endpoints to detect enumeration attempts
Review WooCommerce access logs for unusual product data retrievals
Deploy web application firewall rules to detect product ID enumeration patterns

Monitoring Recommendations

Enable detailed logging for WordPress AJAX requests on WooCommerce sites
Set up alerts for bulk AJAX requests originating from single IP addresses
Monitor for access attempts to non-published product content
Implement anomaly detection for unusual product data access patterns

How to Mitigate CVE-2026-1004

Immediate Actions Required

Update Essential Addons for Elementor to a version newer than 6.5.5
Review WooCommerce product access logs for potential exploitation
Audit draft, pending, and private products for sensitive information exposure
Consider temporarily disabling the Quick View feature until patched

Patch Information

A security patch has been released that adds proper authorization checks to the eael_product_quickview_popup function. The fix implements two critical security checks:

Verifies that the product exists and is visible using WooCommerce's is_visible() method
Confirms that non-administrator users can only access products with publish status

The patch is available in the GitHub commit. For detailed vulnerability analysis, refer to the Wordfence Vulnerability Analysis.

Workarounds

Disable the WooCommerce Quick View widget in Elementor until the plugin is updated
Implement server-level rate limiting on AJAX endpoints
Use a web application firewall to block suspicious enumeration requests
Restrict AJAX endpoint access through .htaccess or server configuration if Quick View is not required

bash

# Example .htaccess rule to restrict AJAX access (temporary workaround)
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php [NC]
    RewriteCond %{QUERY_STRING} action=eael_product_quickview_popup [NC]
    RewriteRule .* - [F,L]
</IfModule>