Unauthorized Data Access in JNews - Jeg Elementor Kit Plugin for WordPress
CVE-2026-103907
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 October 2026
What is CVE-2026-103907?
The JNews - Jeg Elementor Kit plugin for WordPress is susceptible to unauthorized data access due to a lack of capability checks on specific AJAX actions. This vulnerability allows authenticated attackers with Subscriber-level access and higher to gain unauthorized insights into registered users by exploiting the ineffective management of AJAX handlers. By employing the 'jkit_post_block' and 'jeg_find_author' actions, attackers can enumerate user details, including email addresses, through structured queries. This flaw underscores the necessity for robust capability checks to safeguard sensitive user information.
Affected Version(s)
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress 0 <= 3.2.19