CVE-2026-91046

{
  "etk_id": "ETK-2026-2141",
  "cve_id": "CVE-2026-91046",
  "display_id": "CVE-2026-91046",
  "ghsa_id": "GHSA-5ch2-2phm-jp6x",
  "euvd_id": "EUVD-2026-104084",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authorization in ElementsReady Addons for Elementor",
  "summary": "ElementsReady Addons for Elementor through 6.7.2 has settings handlers that do not reliably enforce authorization. An authenticated user with at least subscriber access can modify stored plugin configuration, including API credentials and feature or template settings.",
  "mitigation": "Restrict subscriber-level and other low-privilege WordPress accounts, and remove unneeded accounts until an updated plugin release is available. Review plugin settings and rotate any API credentials stored by the plugin.",
  "vendor": null,
  "product": "ElementsReady Addons for Elementor",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 6.7.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ElementsReady Addons for Elementor",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 4.3,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "epss_score": 0.0018,
  "epss_percentile": 0.0738,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.013380433333333334,
  "t0_at": "2026-10-19T06:00:12.393000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-20T08:32:50.623488+00:00",
      "days": 1.1059980380555556,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T06:00:12.393000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-19T06:00:12.393000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T06:00:12.393000+00:00",
      "url": "https://github.com/advisories/GHSA-5ch2-2phm-jp6x"
    }
  }
}