Unauthorized Template Import in Header Footer Builder for Elementor WordPress Plugin
CVE-2026-12869
Currently unrated
What is CVE-2026-12869?
The Header Footer Builder plugin for Elementor allows users with the 'edit_posts' capability, such as Contributors, to import dashboard templates without proper administrative control. This oversight enables these users to inject potentially harmful JavaScript through an Elementor HTML widget. As a result, any visitor or administrator who loads the site might execute the injected code in their session, leading to serious security implications and unauthorized actions.
Affected Version(s)
Header Footer Builder for Elementor 0 < 1.2.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.