CVE-2026-13345: Essential Addons Info Disclosure Flaw

CVE-2026-13345 Overview

CVE-2026-13345 is an information disclosure vulnerability in the Essential Addons for Elementor WordPress plugin prior to version 6.6.10. The plugin's product-comparison feature resolves WooCommerce products without performing authorization, status, or visibility checks. Unauthenticated attackers can query the endpoint to disclose the title, price, and SKU of products in draft, pending, and private status. These products are otherwise withheld from public catalogs and search results. The flaw affects any WordPress site running Essential Addons for Elementor with WooCommerce integration enabled.

Critical Impact
Unauthenticated remote attackers can enumerate non-public WooCommerce product data, exposing unreleased inventory, pricing strategies, and internal SKUs before publication.

Affected Products

Essential Addons for Elementor WordPress plugin versions before 6.6.10
WordPress sites using the product-comparison feature with WooCommerce integration
WooCommerce stores exposing draft, pending, or private product listings

Discovery Timeline

2026-07-30 - CVE-2026-13345 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-13345

Vulnerability Analysis

The vulnerability resides in the product-comparison feature of Essential Addons for Elementor. This feature accepts a product identifier and returns product metadata for use in the front-end comparison widget. The resolver function does not enforce access control on the requested product. It skips checks that confirm the product is published, publicly visible, and accessible to the requesting user. As a result, the plugin returns metadata for products the site owner has explicitly kept out of public view.

Disclosed fields include the product title, price, and SKU. Site operators use draft and pending status to stage unreleased products. They use private status to restrict visibility to authenticated administrators. Attackers can iterate product identifiers to enumerate the entire non-public catalog. This is classified as Broken Access Control and Information Exposure, related to [CWE-284] and [CWE-200].

Root Cause

The root cause is missing authorization enforcement in the product-comparison request handler. The handler resolves a WooCommerce product object from a supplied identifier and serializes fields into the response. It does not call visibility gates such as is_purchasable(), get_status(), or capability checks like current_user_can('read_private_products'). The AJAX or REST endpoint servicing the feature accepts unauthenticated requests, which compounds the exposure.

Attack Vector

An unauthenticated attacker sends crafted requests to the plugin's product-comparison endpoint. The attacker iterates numeric product IDs and parses the returned title, price, and SKU fields. No authentication, session, or user interaction is required. The attack is remote and network-based. Refer to the WPScan Vulnerability Report for technical details on the request format and affected code paths.

Detection Methods for CVE-2026-13345

Indicators of Compromise

Repeated unauthenticated requests to Essential Addons product-comparison AJAX or REST endpoints from a single source
Sequential enumeration patterns targeting incrementing WooCommerce product IDs in query parameters
Access log entries referencing the plugin's comparison action outside of legitimate front-end referrers

Detection Strategies

Inspect WordPress access logs for high-volume requests to admin-ajax.php containing the Essential Addons product-comparison action parameter
Correlate spikes in product-comparison endpoint traffic with the absence of an authenticated session cookie
Alert when disclosed responses contain product statuses other than publish in returned payloads

Monitoring Recommendations

Enable Web Application Firewall (WAF) logging for the plugin's AJAX and REST routes and forward logs to a centralized SIEM
Baseline normal request rates to product-comparison endpoints and alert on deviations
Monitor WooCommerce audit logs for unusual read access to non-published products

How to Mitigate CVE-2026-13345

Immediate Actions Required

Update Essential Addons for Elementor to version 6.6.10 or later on all affected WordPress sites
Audit WooCommerce product statuses and rotate any SKUs or pricing considered sensitive if disclosure is suspected
Review web server access logs since plugin installation for enumeration patterns against the comparison endpoint

Patch Information

The vendor addressed the issue in Essential Addons for Elementor version 6.6.10 by adding authorization, status, and visibility checks to the product-comparison resolver. Administrators should apply the update through the WordPress plugin manager or by installing the latest release from the official plugin repository. See the WPScan Vulnerability Report for confirmation of the fixed version.

Workarounds

Disable the product-comparison feature within Essential Addons settings until the plugin is updated
Deactivate Essential Addons for Elementor entirely on sites that do not require its widgets
Deploy WAF rules that block unauthenticated requests to the plugin's comparison AJAX action
Restrict access to admin-ajax.php product-comparison actions using server-level allowlists where feasible

bash

# Example WAF rule concept: block unauthenticated product-comparison requests
# ModSecurity pseudo-rule
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,deny,status:403,id:1013345,msg:'Block EAE product-comparison enumeration'"
SecRule ARGS:action "@rx eael_product_grid|eael_product_compare" \
  "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"