Access Control Flaw in ElementInvader Addons for Elementor by Element Invader
CVE-2026-25028

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Elementinvader Addons For Elementor
Vendor
CVE Published:
3 February 2026

What is CVE-2026-25028?

A missing authorization vulnerability in ElementInvader Addons for Elementor allows attackers to exploit incorrectly configured access control security levels. This flaw can enable unauthorized access to sensitive resources, making it imperative for users of affected versions (up to 1.4.1) to upgrade immediately to ensure their installations are secure.

Affected Version(s)

ElementInvader Addons for Elementor 0 <= 1.4.1

References

https://patchstack.com/database/Wordpress/Plugin/elementi...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Legion Hunter | Patchstack Bug Bounty Program
.