CVE-2026-2295: WPZOOM Addons Information Disclosure Flaw

CVE-2026-2295 Overview

The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress contains a missing capability check vulnerability that allows unauthorized access to protected post data. This security flaw exists in the ajax_post_grid_load_more function in all versions up to and including 1.3.2, enabling unauthenticated attackers to retrieve protected post content including draft, future, and pending post titles and excerpts.

Critical Impact

Unauthenticated attackers can access protected WordPress content including unpublished drafts, scheduled posts, and pending review content without any authentication.

Affected Products

• WPZOOM Addons for Elementor – Starter Templates & Widgets plugin versions up to and including 1.3.2
• WordPress installations using vulnerable versions of WPZOOM Elementor Addons

Discovery Timeline

• 2026-02-11 - CVE-2026-2295 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-2295

Vulnerability Analysis

This vulnerability represents a Broken Access Control flaw (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the WPZOOM Addons for Elementor plugin. The vulnerability stems from a missing capability check in the AJAX handler function ajax_post_grid_load_more, which is responsible for loading additional posts in the post grid widget.

WordPress plugins that handle AJAX requests should implement proper capability checks using functions like current_user_can() to verify that the requesting user has appropriate permissions before returning sensitive data. In this case, the vulnerable function fails to verify user capabilities, allowing any unauthenticated visitor to invoke the AJAX endpoint and retrieve post data that should be restricted to authenticated users with appropriate roles.

The attack can be executed remotely over the network without any user interaction or authentication, making it trivially exploitable. However, the impact is limited to information disclosure—specifically the exposure of protected post titles and excerpts—without the ability to modify data or cause system disruption.

Root Cause

The root cause of this vulnerability is the absence of proper authorization checks within the ajax_post_grid_load_more function located in the wpzoom-elementor-ajax-posts-grid.php file. The function processes AJAX requests to load additional posts for the post grid widget but does not validate whether the requesting user has the necessary capabilities to view protected post statuses such as draft, future, or pending posts.

WordPress provides several post statuses that are intended to restrict content visibility:

• Draft: Posts saved but not yet published
• Future: Posts scheduled for future publication
• Pending: Posts awaiting editorial review

Without capability verification, the AJAX handler queries and returns these protected posts to any requester, regardless of authentication status.

Attack Vector

The vulnerability is exploited through the network attack vector via direct AJAX requests to the WordPress admin-ajax endpoint. An attacker can craft HTTP POST requests targeting the ajax_post_grid_load_more AJAX action, which processes the request without verifying user capabilities.

The exploitation flow involves:

1. Identifying a WordPress site using the vulnerable WPZOOM Addons for Elementor plugin
2. Crafting an AJAX POST request to wp-admin/admin-ajax.php with the action parameter set to trigger the vulnerable function
3. Manipulating request parameters to request posts with protected statuses (draft, future, pending)
4. Receiving the protected post titles and excerpts in the AJAX response

The vulnerable code can be examined in the WordPress Plugin File Analysis showing the function at line 66 lacks capability checks before processing the post query.

Detection Methods for CVE-2026-2295

Indicators of Compromise

• Unexpected AJAX requests to admin-ajax.php with the ajax_post_grid_load_more action from unauthenticated sessions
• Unusual patterns of requests querying protected post statuses (draft, future, pending)
• High volume of AJAX requests from single IP addresses targeting post grid functionality
• Access log entries showing successful responses to post grid AJAX calls without corresponding authenticated sessions

Detection Strategies

• Monitor WordPress access logs for requests to admin-ajax.php containing the vulnerable action parameter
• Implement Web Application Firewall (WAF) rules to detect and alert on suspicious AJAX request patterns
• Review server logs for enumeration attempts targeting the post grid AJAX endpoint
• Use WordPress security plugins to monitor for unauthorized data access attempts

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests to capture action parameters and response codes
• Configure alerts for high-frequency AJAX requests from single source IPs
• Monitor for requests that return content containing draft or pending post indicators
• Implement rate limiting on AJAX endpoints to slow potential enumeration attacks

How to Mitigate CVE-2026-2295

Immediate Actions Required

• Update WPZOOM Addons for Elementor plugin to a version newer than 1.3.2 immediately
• Review server access logs for any evidence of exploitation attempts
• Audit any sensitive or confidential content in draft, future, or pending posts that may have been exposed
• Consider temporarily disabling the plugin if an update is not immediately available

Patch Information

The vulnerability has been addressed in the WPZOOM Addons for Elementor plugin. The fix can be reviewed in the WordPress Plugin Changeset which adds proper capability checks to the ajax_post_grid_load_more function. Site administrators should update to the latest version available through the WordPress plugin repository.

Additional details about this vulnerability are available in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the WPZOOM Addons for Elementor plugin until it can be updated
• Implement WAF rules to block unauthenticated requests to the vulnerable AJAX action
• Restrict access to admin-ajax.php using server-level access controls if the post grid functionality is not required
• Move sensitive draft content to a staging environment until the plugin is patched

# Example .htaccess rule to block unauthenticated ajax_post_grid_load_more requests
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*wp-admin/admin-ajax\.php$ [NC]
RewriteCond %{QUERY_STRING} action=ajax_post_grid_load_more [NC,OR]
RewriteCond %{HTTP:Content-Type} ^application/x-www-form-urlencoded
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule .* - [F,L]
</IfModule>