Sensitive Information Exposure in Elementor Website Builder by Elementor

CVE-2026-11905

What is CVE-2026-11905?

The Elementor Website Builder, a widely used page builder plugin for WordPress, has a vulnerability allowing authenticated attackers—those with contributor-level access or higher—to exploit the 'keys_conversion_map' parameter. This exposure enables them to extract sensitive data including the full contents of private, draft, pending, and forthcoming posts, as well as plaintext passwords associated with these posts. This puts the privacy of user data at risk, especially for content created by authors, administrators, and editors.

References