Description WPDeveloper Essential Addons for Elementor存在身份验证绕过漏洞。此漏洞是由于admin-ajax.php接口对于接收的消息校验不正确导致的。
Related VulnerabilitiesPoCCVE-2026-32475: Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form HandlerWordPress Elementor Page Builder 插件 / 文件读取漏洞PoCCVE-2025-14155: Premium Addons for Elementor - Unauthenticated Information DisclosurePoCwp-header-footer-elementor-fpd: WordPress Header Footer Elementor - Full Path DisclosurePoCCVE-2024-29792: Unlimited Elements for Elementor <= 1.5.93 - Cross Site ScriptingPoCwp-elementor-pro-fpd: WordPress Elementor Pro - Full Path DisclosurePoCwordpress-elementor-fpd: WordPress Elementor Page Builder - Full Path DisclosurePoCCVE-2020-13125: Ultimate Addons for Elementor <= 1.24.1 - Registration BypassPoCCVE-2021-4448: Kaswara Modern VC Addons <= 3.0.1 - Missing AuthorizationPoCCVE-2023-37999: HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege EscalationPoCCVE-2022-34487: ShortCode Addons - Unauthenticated Options UpdateWordPress plugin Events Addon for Elementor 跨站脚本漏洞PoCCVE-2022-29455-headless: WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting