Security Alert Summary
The Essential Addons for Elementor plugin for WordPress contains a sensitive information exposure vulnerability in the eael_product_quickview_popup function. An unauthenticated attacker can retrieve WooCommerce product information for products that are in draft, pending, or private status, which should normally be restricted.
CVE Details
- CVE ID: CVE-2026-1004
- Affected plugin / component: The Essential Addons for Elementor plugin for WordPress
- Affected versions: All versions up to and including 6.5.5 (as stated in the CVE entry)
- Published: January 16, 2026 at 9:16 AM (UTC)
- Last modified: January 16, 2026 at 3:55 PM (UTC)
- CVSS v3.1: Base Score 5.3 — MEDIUM; Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Authentication / Privileges / User Interaction: No privileges required (PR:N), no user interaction required (UI:N), unauthenticated access is possible
- Primary impact: Confidentiality: Low; Integrity: None; Availability: None
- CWE / weakness: CWE-862
Technical Details
The vulnerability is a sensitive information exposure issue in the plugin’s eael_product_quickview_popup function. According to the CVE description and provided references, this function can be invoked in a way that allows unauthenticated requests to obtain WooCommerce product data for items whose status is draft, pending, or private. The code context points to handling within the plugin’s Ajax handler implementation (files referenced as Ajax_Handler.php), where the quick-view-related handler does not adequately restrict access to non-public product records.
The practical result is that product metadata intended to be private or in-progress can be returned to an unauthenticated requester. The impact is limited to disclosure of product information; there is no indication in the CVE entry of integrity or availability effects, nor of other escalation beyond information exposure.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff who manage products, and an external contractor who assists with content. If the quick-view handler is accessible without authentication, an unauthenticated attacker could retrieve details about non-public products (for example, upcoming product listings, internal SKUs, or draft descriptions). That information could be used to inform targeted phishing or social engineering against staff or contractors who worked on those products, or to reveal business-sensitive product planning.
The impact is primarily exposure of product data rather than a direct takeover of the site, but the disclosed information can increase risk for targeted attacks against people associated with the site. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (the CVE entry does not specify a fixed version).
- Review and reduce unnecessary user roles and capabilities, especially for contributor-level accounts and external contractors.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual or repeated requests to AJAX or quick-view endpoints that could indicate probing attempts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/WPDevelopers/essential-addons-for-elementor-lite/commit/4e43db06bcf12870cc3b185ed59b3fe2cd227945
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L1439
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L64
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L65
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L820
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Ajax_Handler.php#L832
- https://www.wordfence.com/threat-intel/vulnerabilities/id/06ef9a21-e2b9-40c7-9de5-cff175fa10a5?source=cve
