{"id":"CVE-2026-91046","revision":"d3383e5f47084c83af8324783236b291","records":[{"revision":"d3383e5f47084c83af8324783236b291","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-91046","aliases":[],"title":"ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization","description":"The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.","state":0,"publishedAt":"2026-10-19T06:00:12.393+00:00","modifiedAt":"2026-10-19T09:31:19.851+00:00","affected":[{"ecosystem":"Vendor product","name":"ElementsReady Addons for Elementor","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"ElementsReady Addons for Elementor\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"6.7.2\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unknown\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/ed5271e4-3e8d-49b6-9118-2f4ef5116043/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-91046","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-91046","identifiers":["CVE-2026-91046"]},"retained":false,"historicalAffected":[]}],"coverage":[]}