CVE

CVE-2026-4106

5.3

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days

Attack Vector

Network

Privileges Req.

None

User Interaction

None

ht mega addons for elementor

Updated Sep 28, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

CVE-2026-4106 Scanner

CVE-2026-4106 Scanner - Information Disclosure vulnerability in HT Mega for Elementor

Used 3.3k times · 3.3k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: ht mega addons for elementor

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →