CVE-2026-84146 — Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View

CVE-2026-84146

Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View PUBLISHED

Description (CNA)

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).

Affected (CNA)

Vendor / product	Versions
Unknown / Xpro Addons — 140+ Widgets for Elementor	affected 0 before 1.7.8

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/8e7cdd07-0337-4e0b-adf6-b865e13322a2/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.