CVE-2026-4106 — HT Mega < 3.0.7 – Unauthenticated PII Disclosure

CVE-2026-4106

HT Mega < 3.0.7 – Unauthenticated PII Disclosure PUBLISHED

Description (CNA)

The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days

Affected (CNA)

Vendor / product	Versions
Unknown / HT Mega Addons for Elementor	affected 0 before 3.0.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/9477ead2-3990-4aae-8e66-09ee2f4daa3e/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.