---
id: CVE-2026-110509
title: >-
  Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta
  Disclosure via load_more AJAX Handler
summary: >-
  The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not
  restrict the post type or meta query an unauthenticated visitor can pass to
  its pagination endpoint, which could allow them to read content of non-public
  post typ…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: Essential Addons for Elementor
affected:
  - essential_addons_for_elementor < 6.8.7
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T17:45:52.626056Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:58:07.202Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110509'
references:
  - url: 'https://wpscan.com/vulnerability/da6d12c7-e612-48de-9a57-9d41c36fd409/'
tags:
  - cve.org
epss: 0.00157
epssPercentile: 0.0477
ingestedAt: '2026-10-28T07:06:27.141Z'
---

## Overview

The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.

## Affected

- `essential_addons_for_elementor < 6.8.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.