CVE-2026-13345 in Essential Addons for Elementor Plugin
Summary
by MITRE • 07/30/2026
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability resides in the Essential Addons for Elementor WordPress plugin version 6.6.10 and earlier, specifically within its product-comparison functionality that interfaces with WooCommerce. This flaw represents a critical authorization bypass issue that undermines the fundamental security controls designed to protect sensitive product information. The plugin fails to implement proper access control mechanisms when retrieving WooCommerce product data through its comparison feature, creating an unintended information disclosure channel.
The technical implementation of this vulnerability stems from insufficient validation of user permissions during the product resolution process. When unauthenticated users interact with the product-comparison functionality, the plugin retrieves product information without verifying whether the requesting entity has appropriate authorization levels to access specific product details. This oversight allows malicious actors to obtain sensitive metadata including product titles, pricing information, and stock keeping units for products that are marked as draft, pending review, or private within the WooCommerce system.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with comprehensive visibility into unpublished product inventories. Attackers can exploit this weakness to gather intelligence about upcoming product launches, identify internal product development timelines, and potentially discover sensitive business information contained within product metadata. The exposure of SKU data particularly raises concerns since these identifiers are often used for inventory tracking, supply chain management, and internal business operations.
From a cybersecurity perspective, this vulnerability aligns with CWE-862, which describes insufficient authorization checks, and represents a failure in implementing proper access control mechanisms. The flaw also maps to ATT&CK technique T1213.002, specifically covering data from information repositories, as it enables unauthorized extraction of protected data through legitimate plugin functionality. Organizations using this plugin face elevated risk of competitive intelligence theft and potential business disruption when sensitive product information becomes publicly accessible.
The remediation approach requires implementing comprehensive authorization checks before any product data is returned through the comparison feature. This includes validating user authentication status, verifying appropriate permission levels, and ensuring that only products with proper visibility settings are accessible through the plugin's functionality. Additionally, organizations should consider implementing rate limiting and monitoring for unusual access patterns to detect potential exploitation attempts. The vulnerability serves as a stark reminder of the importance of thorough security testing for WordPress plugins, particularly those integrating with e-commerce platforms that handle sensitive business data.
This issue demonstrates how seemingly minor functionality gaps can create significant security exposures in complex software ecosystems where multiple components interact. The lack of proper input validation and access control enforcement creates an attack surface that malicious actors can exploit to gain unauthorized insights into protected business information, potentially compromising competitive positioning and operational security measures.