Sensitive Information Exposure in Jeg Kit for Elementor Plugin by WordPress
CVE-2026-2916

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Jeg Kit For Elementor – Powerful Addons For Elementor, Widgets & Templates For WordPress
Vendor
CVE Published:
1 August 2026

What is CVE-2026-2916?

The Jeg Kit for Elementor plugin allows authenticated users to access sensitive information due to inadequate security checks in its enqueue_scripts() method. This vulnerability exposes various site configuration details, including plugin inventory, system environment information, and potentially third-party API credentials. As a result, any authenticated user with Contributor-level access or higher can retrieve this data by inspecting the page source on the admin post.php page. Immediate updates are recommended to mitigate the risk of data leakage.

Affected Version(s)

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress 0 <= 3.1.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/jeg-elementor-...
https://plugins.trac.wordpress.org/browser/jeg-elementor-...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
.