CVE-2026-2916 in Jeg Kit for Elementor Plugin
Summary
by MITRE • 08/01/2026
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/01/2026
The Jeg Kit for Elementor WordPress plugin presents a critical sensitive information exposure vulnerability affecting all versions through 3.1.1. This flaw resides within the enqueue_scripts() method of the class/dashboard/class-dashboard.php file where the plugin improperly exposes confidential data through an inline JavaScript object named JkitDashboardOption. The vulnerability demonstrates poor access control practices by failing to implement proper capability checks before rendering sensitive configuration information on admin pages.
The technical implementation of this vulnerability involves the injection of a JavaScript object containing comprehensive plugin inventory details including plugin names, versions, file paths, and active status indicators. Additionally, the script includes system environment metadata such as WordPress version, PHP version, site URLs, and server capabilities. Most concerning is the inclusion of potential third-party API credentials through the jkit_user_data variable which may contain Mailchimp API keys. This information is rendered inline on the post.php admin page without any authentication verification beyond basic post editing privileges.
The operational impact of this vulnerability extends significantly beyond simple information disclosure. Any authenticated user with Contributor-level access or higher can extract sensitive configuration data simply by viewing the page source code through browser developer tools. This creates a substantial risk for attackers who may leverage this information to plan targeted attacks against the WordPress installation and its plugins. The exposure of plugin inventory allows threat actors to identify potentially outdated or vulnerable components, while system environment details provide insights into the technical stack that could be exploited in subsequent attack phases.
From a cybersecurity perspective, this vulnerability aligns with CWE-200 (Information Exposure) and represents a direct violation of the principle of least privilege. The ATT&CK framework categorizes this as a reconnaissance technique where adversaries gather information about the target environment. The lack of capability verification before data output constitutes a privilege escalation vector that could enable attackers to harvest sensitive configuration details for further exploitation. This vulnerability particularly affects WordPress environments where multiple user roles exist, as it creates an information leakage pathway from lower-privilege accounts to sensitive system data.
Organizations should immediately implement mitigations including updating to the latest plugin version if available, implementing role-based access controls to limit Contributor privileges, and monitoring for unauthorized access attempts. The recommended approach involves applying the vendor patch when released, followed by comprehensive security audits of all installed plugins. Additionally, administrators should consider implementing network-level monitoring to detect potential data exfiltration attempts and establish proper logging procedures for admin page access. Regular security assessments including vulnerability scanning and penetration testing can help identify similar exposure issues across the WordPress ecosystem.