Security Alert Summary
The HT Mega Addons for Elementor WordPress plugin contains an unauthenticated AJAX action that can return personally identifiable information (PII) for customers who placed orders in the last seven days. The vulnerability affects plugin versions before 3.0.7 and allows data exposure without authentication.
CVE Details
- CVE ID:
CVE-2026-4106 - Affected component: HT Mega Addons for Elementor WordPress plugin
- Affected versions: Versions before 3.0.7
- Published: April 23, 2026 7:16:41 AM UTC
- Last modified: April 23, 2026 4:21:06 PM UTC
- CVSS v3.1: Base Score 7.5, Severity: HIGH, Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Authentication required: None (unauthenticated)
- Privileges required: None
- User interaction: None
- Primary impact:
- Confidentiality: High (exposure of customer PII)
- Integrity: None
- Availability: None
- CWE / weakness ID: Not provided
Technical Details
According to the report, an unauthenticated AJAX action in HT Mega Addons for Elementor returns some personally identifiable information (PII) such as full name, city, state, and country for customers who placed orders in the previous seven days. Because the action is accessible without authentication or privileges, an attacker can access this data over the network without user interaction.
The root cause is a publicly accessible AJAX/API action that returns order-related PII for recent purchases. The description specifies the timeframe (customers who placed orders in the last 7 days) and that the action is unauthenticated, which enables data disclosure. The report identifies affected versions as those before 3.0.7.
How This Could Impact Your Website
On a typical WordPress site using this plugin, a successful request to the vulnerable action could reveal personal details for recent customers. In a small-business scenario, consider the following roles:
- Site owner: May find that customer contact details for recent orders are accessible without authentication.
- Internal staff (sales/customer support): Could face an increased burden responding to customer concerns if PII is leaked.
- External contractors or contributors: If they discover the endpoint, they could expose or aggregate customer data unintentionally.
Practical consequences include exposure of customer names and location data, which can be used to craft targeted phishing or social engineering campaigns against customers or staff. The issue is limited to confidentiality impact as reported; it does not indicate integrity or availability impact. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level and above accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior or unexpected requests to AJAX/API endpoints.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
