CVE-2026-91047 — ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter

CVE-2026-91047

ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter PUBLISHED

Description (CNA)

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.

Affected (CNA)

Vendor / product	Versions
Unknown / ElementsReady Addons for Elementor	affected 0 through 6.7.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/08afea88-4268-40b3-b5fb-0ac2546c3100/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.