A Cross-Site Request Forgery (CSRF) vulnerability exists in Elementor Website Builder from n/a through 4.3.1. This issue allows for Cross Site Request Forgery. The vulnerability impacts Elementor Website Builder installations, allowing attackers to perform unauthorized actions on behalf of users. Defenders should assess exposure and prioritize verification and updates to prevent potential CSRF attacks. Th [truncated]
This CVE debrief covers CVE-2026-8825, a vulnerability in the Elementor Website Builder WordPress plugin. The issue allows authenticated users with Contributor-level access and above to retrieve private post, page, and draft data through REST endpoints. This exposure affects users who haven't updated to version 4.1.4 or later. The vulnerability is considered medium severity, requiring immediate attention [truncated]
