{"schema":"threatline.record/2","record":{"id":"CVE-2026-11905","aliases":[],"summary":"Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters","details":"The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full post_content and plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors.","categories":["Unclassified"],"product":"Elementor Website Builder – more than just a page builder","vendor":"elemntor","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-11905","source_modified_at":"2026-10-15T16:43:40.250Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Elementor Website Builder – more than just a page builder","vendor":"elemntor","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.2.3","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00284,"percentile":0.19879,"score_date":"2026-10-23"},"published_at":"2026-10-15T06:41:58.987Z","modified_at":"2026-10-15T16:43:40.250Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-11905","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T16:43:40.250Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-11905","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a018a58-2184-4031-99a8-4aad55bcc815?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/elementor/tags/4.1.2/modules/wp-rest/classes/post-query.php#L71"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/elementor/tags/4.1.2/modules/wp-rest/classes/post-query.php#L62"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/elementor/tags/4.1.2/modules/wp-rest/classes/post-query.php#L108"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/elementor/tags/4.1.2/modules/wp-rest/base/query.php#L106"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/elementor/tags/4.0.3/modules/wp-rest/classes/post-query.php#L71"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/elementor/tags/4.0.3/modules/wp-rest/classes/post-query.php#L62"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/elementor/tags/4.0.3/modules/wp-rest/classes/post-query.php#L108"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/elementor/tags/4.0.3/modules/wp-rest/base/query.php#L106"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3674524%40elementor&new=3674524%40elementor"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T10:44:25.662373Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T16:43:40.250Z","content_hash":"9d773cec5193d58d6e0b5aac95270243a7d78a7485ac248773b22095fad25de3"}}