What the vulnerability does
01Description
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `Live_Action::reset()` function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress `init` action and triggers when both `post` and `action=elementor` GET parameters are present, with no authentication or nonce verification. This makes it possible for unauthenticated attackers to overwrite the Elementor content (`_elementor_data`) of any `elementskit_widget` custom post type by visiting a specially crafted URL. The widget's custom designs, text, and configurations are permanently replaced with a blank template.
Explanation of Vulnerability in Simple Terms
02Summary
ElementsKit Elementor Addons versions 3.8.2 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify site data. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 3.8.2 to prevent unauthorized changes to site content and functionality.
What an attacker can do
03Attacker Capabilities
Modify site data without logging in or having permission to do so.
Potential impact on your site
04Site Impact
Attackers can alter site content and settings without your knowledge or permission.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 5, 2026
CVE published
May 5, 2026
Record updated
