CVE-2026-2916 MEDIUM

CVE-2026-2916: Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script

Vendor Jegtheme
Product Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
Weakness CWE-200 · Info exposure
Published August 1, 2026
Last update August 3, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys.

Explanation of Vulnerability in Simple Terms

02Summary

Jeg Kit for Elementor versions up to 3.1.1 expose sensitive information to authenticated users. A logged-in user with low privileges can access data they should not be able to view. The plugin does not properly restrict access to certain information based on user role or capability. Update to a version newer than 3.1.1 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Read sensitive information that should be restricted from their user role.

Potential impact on your site

04Site Impact

Authenticated users can view private or restricted data, risking exposure of site configuration or other users' information.

Conditions required to exploit

05Prerequisites

Attacker must be logged in to the WordPress site with at least a low-privilege account.

Key dates

06Disclosure timeline

August 1, 2026 CVE published
August 3, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-15508 Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure CVE-2026-1307 Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token CVE-2026-60031 Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 CVE-2026-16773 WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action CVE-2026-1371 Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action