CVE-2026-4362: ElementsKit Elementor Auth Bypass Flaw

CVE-2026-4362 Overview

CVE-2026-4362 is a missing authorization vulnerability [CWE-862] in the ElementsKit Elementor Addons plugin for WordPress. The flaw affects all versions up to and including 3.8.2. The Live_Action::reset() function is hooked to the WordPress init action without authentication or nonce verification. Unauthenticated attackers can overwrite the _elementor_data post meta of any elementskit_widget custom post type by visiting a crafted URL containing post and action=elementor GET parameters. Successful exploitation replaces a widget's custom designs, text, and configurations with a blank template.

Critical Impact

Unauthenticated attackers can permanently destroy ElementsKit widget content on affected WordPress sites by sending a single GET request, causing data loss and site defacement.

Affected Products

• ElementsKit Elementor Addons (elementskit-lite) plugin for WordPress
• All versions through 3.8.2
• Fixed in version 3.9.0

Discovery Timeline

• 2026-05-05 - CVE-2026-4362 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-4362

Vulnerability Analysis

The vulnerability resides in the Live_Action::reset() method within modules/widget-builder/live-action.php of the ElementsKit Elementor Addons plugin. The method is registered as a callback to the WordPress init action, which fires on every request including those from unauthenticated visitors. When the request contains both a post parameter and action=elementor query parameter, the function executes without verifying user capabilities or validating a WordPress nonce.

The handler reaches an update_post_meta() call that overwrites the _elementor_data meta value of the targeted elementskit_widget custom post type with a blank template. Because no current_user_can() check or check_admin_referer() validation gates the operation, any visitor can trigger it. The integrity and availability impact is limited to ElementsKit widget posts, which is reflected in the I:L/A:L vector components.

Root Cause

The root cause is a missing capability check. WordPress requires plugins to validate that the current user holds the appropriate capability (typically edit_post or manage_options) before performing state-changing operations. The Live_Action::reset() function omits both capability validation and nonce verification, allowing the destructive action to be invoked by any unauthenticated request.

Attack Vector

An attacker enumerates or guesses the post ID of an elementskit_widget custom post and issues a single HTTP GET request to the WordPress site root with the post={ID} and action=elementor parameters. The init hook fires, Live_Action::reset() executes, and the widget's _elementor_data is replaced with an empty template. The attack requires no authentication, no user interaction, and no special privileges.

For implementation details, see the WordPress ElementsKit Live Action Code and the WordPress Change Set 3499543 that addresses the issue.

Detection Methods for CVE-2026-4362

Indicators of Compromise

• HTTP GET requests to the WordPress site containing both post= and action=elementor query parameters from unauthenticated sources
• ElementsKit widgets unexpectedly displaying blank or default template content after a request burst
• Audit log entries showing _elementor_data post meta updates on elementskit_widget posts without an associated authenticated user session

Detection Strategies

• Inspect web server access logs for requests matching the pattern GET /?post=*&action=elementor originating from unauthenticated clients
• Monitor WordPress database changes to the wp_postmeta table where meta_key='_elementor_data' and post_type='elementskit_widget'
• Compare current widget content against known-good backups to identify silent overwrites

Monitoring Recommendations

• Enable WordPress audit logging plugins to track post meta modifications and correlate with authenticated user sessions
• Alert on anomalous spikes in requests carrying the action=elementor parameter from non-admin IP ranges
• Review the Wordfence Vulnerability Report for signature updates and indicator feeds

How to Mitigate CVE-2026-4362

Immediate Actions Required

• Update the ElementsKit Elementor Addons plugin to version 3.9.0 or later on all WordPress installations
• Take a full backup of the WordPress database before applying the update so widget content can be restored if needed
• Audit existing elementskit_widget posts for unexpected blank _elementor_data values and restore from backup where required

Patch Information

The vendor addressed CVE-2026-4362 in ElementsKit Elementor Addons version 3.9.0. The fix introduces capability and nonce checks in the Live_Action::reset() function. Review the diff in the WordPress Update Change Set 3.8.2 to 3.9.0 to confirm the patched logic.

Workarounds

• If immediate patching is not possible, deactivate the ElementsKit Elementor Addons plugin until the upgrade can be applied
• Deploy a Web Application Firewall rule that blocks unauthenticated requests containing both post and action=elementor query parameters
• Restrict access to the /wp-admin and front-controller endpoints by IP allowlist where feasible

# Example WAF rule (ModSecurity) to block the exploit pattern
SecRule REQUEST_METHOD "@streq GET" \
  "chain,id:1026004362,phase:1,deny,status:403,\
   msg:'Block CVE-2026-4362 ElementsKit Live_Action reset attempt'"
  SecRule ARGS:action "@streq elementor" "chain"
    SecRule ARGS:post "@rx ^[0-9]+$"