What the vulnerability does
01Description
The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.
Explanation of Vulnerability in Simple Terms
02Summary
Elementor Website Builder versions up to 3.35.7 contain an authorization flaw that allows authenticated users to access sensitive information they should not be able to view. The vulnerability requires a valid user account and network access but does not require user interaction. Site administrators should update to a version newer than 3.35.7 to remediate this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive information accessible only to higher-privileged users.
Potential impact on your site
04Site Impact
Authenticated users can view data they shouldn't have access to, risking exposure of private site information.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account on the site.
Key dates
06Disclosure timeline
March 26, 2026
CVE published
April 8, 2026
Record updated
