CVE-2026-13345: unknown essential addons for elementor
Vulnerability summary
CVE-2026-13345 is a medium (CVSS 5.3) vulnerability in unknown essential addons for elementor. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.8% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 6.6.10.
Timeline
- 30-07-2026PublishedVulnerability first disclosed.
- 30-07-2026Last modifiedVulnerability information updated.
Description
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
+0.08 pp
From 0.24% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Unknown1 product
- essential addons for elementor< 6.6.10
Wordpress1 product
- essential-addons-for-elementor-lite< 6.6.10
2 vendors · 2 products