CVE-2026-2386

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2386", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-12T00:09:22.280Z", "datePublished": "2026-02-18T12:28:34.722Z", "dateUpdated": "2026-04-08T16:52:08.178Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:08.178Z"}, "affected": [{"vendor": "posimyththemes", "product": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.4.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpae_create_page() AJAX handler authorizing users only with current_user_can('edit_posts') while accepting a user-controlled 'post_type' value passed directly to wp_insert_post() without post-type-specific capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to create arbitrary draft posts for restricted post types (e.g., 'page' and 'nxt_builder') via the 'post_type' parameter."}], "title": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc3e24a-8b51-4b6f-bacf-665ceb03bc05?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3463156/the-plus-addons-for-elementor-page-builder"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2026-02-12T00:24:51.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-18T00:04:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T20:22:42.695001Z", "id": "CVE-2026-2386", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T20:22:50.157Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2386", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T20:22:42.695001Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T20:22:47.137Z"}}], "cna": {"title": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "posimyththemes", "product": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.4.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-12T00:24:51.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-18T00:04:23.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc3e24a-8b51-4b6f-bacf-665ceb03bc05?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3463156/the-plus-addons-for-elementor-page-builder"}], "descriptions": [{"lang": "en", "value": "The The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpae_create_page() AJAX handler authorizing users only with current_user_can('edit_posts') while accepting a user-controlled 'post_type' value passed directly to wp_insert_post() without post-type-specific capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to create arbitrary draft posts for restricted post types (e.g., 'page' and 'nxt_builder') via the 'post_type' parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:08.178Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2386", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:52:08.178Z", "dateReserved": "2026-02-12T00:09:22.280Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T12:28:34.722Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce", "vendor": "posimyththemes", "versions": [{"lessThanOrEqual": "6.4.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpae_create_page() AJAX handler authorizing users only with current_user_can('edit_posts') while accepting a user-controlled 'post_type' value passed directly to wp_insert_post() without post-type-specific capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to create arbitrary draft posts for restricted post types (e.g., 'page' and 'nxt_builder') via the 'post_type' parameter."}, {"lang": "es", "value": "El plugin The Plus Addons para Elementor \u2013 Addons para Elementor, Page Templates, Widgets, Mega Menu, WooCommerce para WordPress es vulnerable a una autorizaci\u00f3n incorrecta en todas las versiones hasta la 6.4.7, ambas inclusive. Esto se debe a que el manejador AJAX tpae_create_page() autoriza a los usuarios solo con current_user_can('edit_posts') mientras acepta un valor 'post_type' controlado por el usuario pasado directamente a wp_insert_post() sin comprobaciones de capacidad espec\u00edficas del tipo de publicaci\u00f3n. Esto hace posible que atacantes autenticados, con acceso de nivel Autor y superior, creen publicaciones borrador arbitrarias para tipos de publicaci\u00f3n restringidos (por ejemplo, 'page' y 'nxt_builder') a trav\u00e9s del par\u00e1metro 'post_type'."}], "id": "CVE-2026-2386", "lastModified": "2026-06-17T10:30:52.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2386", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T20:22:42.695001Z", "version": "2.0.3"}}]}, "published": "2026-02-18T13:16:21.423", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3463156/the-plus-addons-for-elementor-page-builder"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc3e24a-8b51-4b6f-bacf-665ceb03bc05?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.4.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce", "source": "cna", "vendor": "posimyththemes"}, "product": "the_plus_addons_for_elementor_\u2013_addons_for_elementor,_page_templates,_widgets,_mega_menu,_woocommerce", "vendor": "posimyththemes"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 70.0, "confidence_source": "inferred", "scores": [{"score": 70.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:13:57.239963+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to the latest release that removes the insecure tpae_create_page handler.", "If an upgrade cannot be performed immediately, block or limit access to the tpae_create_page AJAX endpoint for users with edit_posts capability, ensuring that only admins may invoke it.", "Implement server\u2011side validation to reject or sanitize the 'post_type' parameter so that only whitelisted, authorized post types can be created."], "summary": {"action": "Update Plugin", "impact": "Authenticated users can create unauthorized draft posts for restricted post types"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin up to and including version 6.4.7. The issue affects the plugin itself; no other components are explicitly listed.", "description_and_impact": "The Plus Addons for Elementor plugin contains an AJAX handler that authorizes users only with the general 'edit_posts' capability while passing a user-controlled 'post_type' directly to WordPress's wp_insert_post. This bypasses post\u2011type specific permission checks, allowing any authenticated author or higher to create draft posts for normally restricted types such as 'page' and 'nxt_builder', effectively granting unauthorized content creation.", "risk_and_exploitability": "The CVSS score of 4.3 indicates low\u2011to\u2011moderate severity. The EPSS score is below 1% and the vulnerability is not listed in CISA\u2019s KEV catalog, suggesting limited exploitation activity so far. Based on the description, the likely attack vector is remote via the plugin\u2019s AJAX endpoint, requiring the attacker to be authenticated with Author\u2011level privileges or higher. Once authenticated, an attacker can submit the 'post_type' parameter to create arbitrary draft content."}}}}, "created": "2026-02-19T10:20:17.006545+00:00", "updated": "2026-04-15T18:15:10.858108+00:00", "vendors": ["posimyththemes", "posimyththemes$PRODUCT$the_plus_addons_for_elementor_\u2013_addons_for_elementor,_page_templates,_widgets,_mega_menu,_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}