UpHeron
All vulnerabilities

WordPress plugins

CVE-2026-11905

Elementor Website Builder – more than just a page builder: Missing Authorization

Severity
Medium 4.3
Published
25 Sept 2026
Last changed
15 Oct 2026
Added to UpHeron
15 Oct 2026
Fixed in
4.2.4
Also known as
WPV-928f0366f173
Sources
CVE Program, WPVulnerability

Description

Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters

Affected software

SoftwareAffected versions
ElementorWordPress plugins · wp-plugin:elementor
  • Every version up to 4.2.3
  • Every version before 4.2.4

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-11905
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elementor/elementor-website-builder-423-missing-authorization-to-authenticated-contributor-sensitive-information-exposure-via-is-public-and-keys-conversion-map-parameters