CVE-2026-2386: Elementor Plus Addons Auth Bypass Flaw

CVE-2026-2386 Overview

The Plus Addons for Elementor plugin for WordPress contains an Incorrect Authorization vulnerability in all versions up to and including 6.4.7. The vulnerability exists in the tpae_create_page() AJAX handler, which incorrectly authorizes users using only the current_user_can('edit_posts') capability check while accepting user-controlled post_type values passed directly to wp_insert_post() without implementing post-type-specific capability checks. This authorization flaw allows authenticated attackers with Author-level access or above to create arbitrary draft posts for restricted post types.

Critical Impact

Authenticated attackers with Author-level access can create unauthorized draft posts for restricted post types such as page and nxt_builder, potentially bypassing content management controls and creating malicious content within the WordPress installation.

Affected Products

• The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin versions up to and including 6.4.7
• WordPress installations using vulnerable versions of The Plus Addons for Elementor

Discovery Timeline

• 2026-02-18 - CVE-2026-2386 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2386

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), a common web application security flaw where authorization checks are insufficient to properly restrict user actions. The core issue lies in the plugin's AJAX handler implementation, which performs only a generic capability check rather than validating permissions for the specific post type being created.

When the tpae_create_page() function processes AJAX requests, it verifies that the current user has the edit_posts capability. While this confirms the user can edit posts in general, it fails to account for WordPress's granular permission model where different post types may require different capabilities. For example, creating a page post type typically requires edit_pages capability, which Authors do not possess by default.

The vulnerability enables authenticated users with Author-level permissions to circumvent WordPress's built-in content type restrictions. By manipulating the post_type parameter in the AJAX request, an attacker can instruct the plugin to create draft posts for restricted post types like page or custom post types such as nxt_builder.

Root Cause

The root cause is the insufficient authorization check in the tpae_create_page() AJAX handler. The function uses a single current_user_can('edit_posts') check which does not account for post-type-specific capabilities. WordPress's permission model requires checking capabilities like edit_pages for page post types or custom capabilities for registered custom post types. The user-controlled post_type parameter is passed directly to wp_insert_post() without validating whether the user has the appropriate capability to create content of that specific type.

Attack Vector

The attack requires network access and authenticated user credentials with at least Author-level privileges on the WordPress installation. An attacker can craft a malicious AJAX request to the tpae_create_page action, specifying a restricted post_type parameter value such as page or nxt_builder. Since the handler only checks for edit_posts capability (which Authors have), the request bypasses the intended authorization controls. The wp_insert_post() function then creates a draft post of the attacker-specified type.

The vulnerability mechanism involves intercepting or crafting an AJAX request to the WordPress admin-ajax.php endpoint with the tpae_create_page action. By including a post_type parameter set to a restricted post type, the attacker exploits the missing capability validation to create unauthorized content. See the Wordfence Vulnerability Analysis for additional technical details.

Detection Methods for CVE-2026-2386

Indicators of Compromise

• Unexpected draft posts appearing for page or nxt_builder post types created by Author-level users
• AJAX requests to admin-ajax.php with the tpae_create_page action containing unusual post_type parameter values
• Author accounts creating content types they should not have permissions to access

Detection Strategies

• Monitor WordPress audit logs for post creation events where the post type does not match the user's expected capabilities
• Implement Web Application Firewall (WAF) rules to inspect AJAX requests to admin-ajax.php for suspicious post_type parameter manipulation
• Review server access logs for repeated requests to admin-ajax.php with the tpae_create_page action from authenticated sessions

Monitoring Recommendations

• Enable WordPress activity logging to track all post creation events with user attribution
• Configure alerts for draft posts created with restricted post types by non-administrative users
• Periodically audit draft content across all post types to identify unauthorized entries

How to Mitigate CVE-2026-2386

Immediate Actions Required

• Update The Plus Addons for Elementor plugin to a version newer than 6.4.7 immediately
• Review existing draft posts across all post types for unauthorized content created by Author-level users
• Audit Author-level user accounts for suspicious activity related to content creation
• Consider temporarily restricting Author capabilities or disabling the plugin until patching is complete

Patch Information

The vulnerability has been addressed in versions released after 6.4.7. The patch is available through the WordPress Plugin Change Log, which implements proper post-type-specific capability checks before allowing post creation via the tpae_create_page() AJAX handler.

Workarounds

• Temporarily demote Author-level users to Contributor level if they do not require publish capabilities
• Implement a custom capability filter to restrict access to the vulnerable AJAX action
• Use a security plugin to add additional authorization layers to AJAX handlers
• Consider implementing a WAF rule to block or log requests to the tpae_create_page AJAX action with non-standard post_type values

# WordPress CLI command to list all Author users for review
wp user list --role=author --fields=ID,user_login,user_email

# Check for unexpected draft posts created by Author users
wp post list --post_status=draft --post_type=page --fields=ID,post_title,post_author,post_date