Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-103907 · Microsoft / collected KEV context

cve-program · CVE-2026-103907

• https://www.wordfence.com/threat-intel/vulnerabilities/id/936186f9-185a-481e-a8df-5a2a3def9188?source=cve
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/lib/jeg-element/includes/class/class-ajax.php#L101
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/lib/jeg-element/includes/class/elements/class-elements-option-abstract.php#L106
• https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/lib/jeg-element/includes/class/elements/class-elements-option-abstract.php#L63
• https://plugins.trac.wordpress.org/changeset/3722837/jeg-elementor-kit

No related operational record is retained in the current change model.