CVE-2026-2916: Jeg Kit for Elementor Info Disclosure

CVE-2026-2916 Overview

CVE-2026-2916 is a sensitive information exposure vulnerability [CWE-200] in the Jeg Kit for Elementor plugin for WordPress. The flaw affects all versions up to and including 3.1.1. The enqueue_scripts() method in class/dashboard/class-dashboard.php injects a JkitDashboardOption JavaScript object into the post.php admin page without an appropriate capability check. The exposed object contains full plugin inventory, WordPress and PHP versions, site URLs, server capabilities, and potentially third-party API credentials such as a Mailchimp API key stored in jkit_user_data. Authenticated users with Contributor-level access or higher can view this data by inspecting the page source.

Critical Impact
Authenticated Contributor-level users can extract site configuration data, installed plugin details, and potentially third-party API keys such as Mailchimp credentials from any WordPress site running Jeg Kit for Elementor 3.1.1 or earlier.

Affected Products

Jeg Kit for Elementor plugin for WordPress, all versions up to and including 3.1.1
Fixed in Jeg Kit for Elementor version 3.1.2
WordPress installations exposing the post.php admin page to Contributor or higher accounts

Discovery Timeline

2026-08-01 - CVE-2026-2916 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-2916

Vulnerability Analysis

The plugin's dashboard component enqueues an inline JavaScript block on the WordPress post.php admin page. That block defines a JkitDashboardOption object populated server-side with configuration data intended for the plugin's dashboard UI. The data set includes plugin names, versions, filesystem paths, active status flags, the WordPress core version, the PHP version, resolved site URLs, and server capability indicators. It also embeds user-scoped data via jkit_user_data, which can carry a Mailchimp API key when a site administrator has configured the integration.

WordPress serves post.php to any role that can edit posts, including Contributors. Because the plugin does not gate the inline script on a higher capability such as manage_options, every authenticated user with post-editing rights receives the full payload. Retrieval requires only viewing page source, so no exploit tooling is needed.

Root Cause

The root cause is missing authorization on data output. The enqueue_scripts() handler runs on admin page loads without verifying that the current user should see plugin inventory or integration secrets. The dashboard payload was designed for administrator context but was attached to a broadly accessible admin screen, collapsing the intended trust boundary between Contributors and Administrators.

Attack Vector

Exploitation requires an authenticated account with at least Contributor privileges. The attacker opens or previews any post in the WordPress admin, loads post.php, and reads the rendered HTML. The JkitDashboardOption object is present as inline JavaScript. Parsing the object yields the site's plugin inventory, environment fingerprint, and any stored third-party credentials. Extracted API keys can then be reused against the corresponding third-party services from outside the WordPress environment.

See the Wordfence Vulnerability Analysis and the WordPress Plugin Dashboard Code for the affected code paths.

Detection Methods for CVE-2026-2916

Indicators of Compromise

Presence of a JkitDashboardOption JavaScript object in post.php responses served to non-administrative users.
Unexpected outbound requests to api.mailchimp.com or other integrated third-party APIs originating from IP addresses not associated with the site administrator.
Access log entries showing Contributor or Author accounts repeatedly loading post.php or post-new.php without editing activity.

Detection Strategies

Review the installed Jeg Kit for Elementor version across managed WordPress sites and flag any instance at 3.1.1 or lower.
Inspect rendered admin HTML under a low-privileged test account and search for JkitDashboardOption and jkit_user_data markers.
Correlate WordPress audit logs with third-party API usage logs to identify credential reuse from unfamiliar sources after Contributor logins.

Monitoring Recommendations

Enable WordPress audit logging for role changes, plugin installations, and admin page access by non-administrator roles.
Monitor Mailchimp and other integrated services for API calls originating outside expected server IP ranges.
Track plugin version inventory across WordPress fleets and alert when known-vulnerable plugin versions are detected.

How to Mitigate CVE-2026-2916

Immediate Actions Required

Update Jeg Kit for Elementor to version 3.1.2 or later on all WordPress installations.
Rotate any third-party API keys, including Mailchimp keys, that were configured in the plugin while a vulnerable version was installed.
Audit user accounts and remove or downgrade unnecessary Contributor, Author, and Editor accounts.

Patch Information

The vendor addressed the issue in Jeg Kit for Elementor version 3.1.2. The code changes are documented in the WordPress Plugin Changeset 3.1.1 to 3.1.2. Apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

Restrict access to the WordPress admin area to trusted administrator accounts until the plugin is updated.
Temporarily deactivate Jeg Kit for Elementor if the update cannot be applied immediately.
Remove stored third-party API credentials from the plugin configuration until version 3.1.2 is deployed.

bash

# Update via WP-CLI once the patched release is available
wp plugin update jeg-elementor-kit --version=3.1.2
wp plugin get jeg-elementor-kit --field=version