CVE-2026-11905: Elementor WordPress Information Disclosure

CVE-2026-11905 Overview

The Elementor Website Builder plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 4.2.3. The flaw resides in the keys_conversion_map parameter handled by the plugin's WP REST query module. Authenticated users with contributor-level access or above can extract the full post_content and plaintext post_password of private, draft, pending, and future posts. The exposed posts can belong to any author, including Administrators and Editors. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Low-privileged contributors can read unpublished content and plaintext passwords of posts owned by Administrators and Editors across the WordPress site.

Affected Products

Elementor Website Builder plugin for WordPress — all versions up to and including 4.2.3
Elementor branch 4.0.x (confirmed in tag 4.0.3)
Elementor branch 4.1.x (confirmed in tag 4.1.2)

Discovery Timeline

2026-10-15 - CVE-2026-11905 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-11905

Vulnerability Analysis

The vulnerability lives in the Elementor WP REST module, specifically in modules/wp-rest/base/query.php and modules/wp-rest/classes/post-query.php. The query layer accepts a client-supplied keys_conversion_map parameter that controls which post fields are returned by the REST endpoint. The code does not enforce an authorization check that restricts callers to fields they are permitted to view. As a result, a contributor can request sensitive fields such as post_content and post_password on posts owned by other users. Private, draft, pending, and scheduled (future) posts are all reachable through this path. The data returns in cleartext because WordPress stores post_password without hashing by design.

Root Cause

The root cause is a missing authorization control [CWE-862] on field-level access within the plugin's custom REST query handler. The handler trusts the attacker-controlled keys_conversion_map to map requested keys to post object properties. It does not reconcile that mapping against the caller's capabilities, such as read_private_posts or ownership of the post. The REST module therefore bypasses the capability model WordPress normally enforces on edit_post and read_post.

Attack Vector

Exploitation requires only an authenticated session at the contributor role or higher. An attacker sends a crafted REST API request to the vulnerable Elementor endpoint, supplying a keys_conversion_map that selects post_content and post_password. The server returns those fields for posts the attacker should not be able to read, including Administrator and Editor drafts. No user interaction and no elevated privileges are required beyond the contributor role. The exploit prediction score is low, but the barrier to abuse on multi-author WordPress sites is minimal.

For code-level context, see the vulnerable handlers in post-query.php L62, post-query.php L71, and post-query.php L108.

Detection Methods for CVE-2026-11905

Indicators of Compromise

REST API requests to Elementor WP REST endpoints containing a keys_conversion_map parameter that references post_content or post_password.
Access log entries where contributor-level accounts query posts they do not own, particularly posts with status private, draft, pending, or future.
Unexpected content reuse or publication of material that previously existed only as unpublished drafts.

Detection Strategies

Inspect web server and WordPress audit logs for GET or POST requests to /wp-json/elementor/ routes that include the keys_conversion_map key.
Correlate REST calls against the authenticated user's role and the queried post's author to flag cross-author access by contributors.
Enable WordPress REST API logging plugins or a Web Application Firewall rule set that records REST query parameters for the Elementor module.

Monitoring Recommendations

Alert on any contributor or author role issuing REST queries that return post_password values.
Baseline normal Elementor REST traffic volumes per account and alert on sudden spikes consistent with enumeration.
Review newly created low-privilege accounts and monitor their first REST activity for signs of reconnaissance.

How to Mitigate CVE-2026-11905

Immediate Actions Required

Update Elementor to a version later than 4.2.3 that includes the fix referenced in Elementor Change Set 3674524.
Audit contributor, author, and editor accounts, and remove or disable any that are inactive or unknown.
Rotate post_password values on any private, draft, pending, or future posts that may have been exposed.

Patch Information

The vendor addressed the issue in a patch applied to the Elementor plugin trunk, tracked as changeset 3674524. Site operators should install the latest Elementor release through the WordPress plugin updater and verify the installed version is greater than 4.2.3. See the Wordfence Vulnerability Report for additional advisory detail.

Workarounds

If immediate patching is not possible, restrict access to Elementor REST endpoints at the Web Application Firewall layer for non-administrator roles.
Temporarily revoke the contributor role from untrusted accounts or convert them to subscriber role until the plugin is updated.
Block REST requests that include the keys_conversion_map parameter referencing post_content or post_password fields.

bash

# Example WAF rule concept to block requests referencing sensitive keys
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /wp-json/elementor/" \
  "chain,deny,status:403,id:1026011905,msg:'Block Elementor keys_conversion_map abuse'"
  SecRule ARGS_NAMES "@rx keys_conversion_map" \
    "chain"
    SecRule ARGS "@rx (post_password|post_content)"