{"id":"CVE-2026-91046","published":"2026-10-19T06:17:25.223","lastModified":"2026-10-19T21:04:50.950","description":"The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/ed5271e4-3e8d-49b6-9118-2f4ef5116043/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}