CVE-2026-1004: 
WordPress vulnerability analysis and mitigation

CVE-2026-1004 is a Sensitive Information Exposure vulnerability in the Essential Addons for Elementor plugin for WordPress, affecting all versions up to and including 6.5.5. The flaw exists in the eael_product_quickview_popup function and allows unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status that should be access-restricted. It was published on January 16, 2026, with the fix committed to the plugin repository shortly thereafter. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (Wordfence, NVD).

The root cause is Missing Authorization (CWE-862): the eael_product_quickview_popup AJAX handler in includes/Traits/Ajax_Handler.php fetched WooCommerce product data by ID without verifying whether the product was publicly visible or whether the requesting user had permission to view non-published posts. Specifically, the function called wc_get_product($product_id) and returned product details without checking $product->is_visible() or the post's publication status for non-administrative users. An unauthenticated attacker could supply any product ID in an AJAX request to this endpoint and receive full product data regardless of its draft, pending, or private status. The patch (commit 4e43db0) added checks for $product->is_visible() and post status against current_user_can('edit_post', $product_id) to block unauthorized access (GitHub Commit, Wordfence).

Successful exploitation allows unauthenticated remote attackers to read WooCommerce product data — including titles, descriptions, pricing, and metadata — for products intentionally kept in draft, pending, or private status. This could expose unreleased product information, confidential pricing strategies, or internal product details to competitors or malicious actors. There is no integrity or availability impact; the vulnerability is limited to confidentiality loss of WooCommerce product data (Wordfence, NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.035% (0.000350), indicating a low probability of exploitation in the near term. The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker against unpatched sites. It is not currently listed in the CISA Known Exploited Vulnerabilities catalog (Wordfence, NVD).

1. Reconnaissance: Identify WordPress sites running the Essential Addons for Elementor plugin (version ≤ 6.5.5) with WooCommerce active, using tools like WPScan or by inspecting page source for plugin indicators.
2. Enumerate product IDs: Attempt to enumerate WooCommerce product IDs by iterating common integer values (e.g., starting from 1) or by observing product IDs exposed in public pages.
3. Craft AJAX request: Send an unauthenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to eael_product_quickview_popup and the target product_id as a POST parameter.
4. Retrieve restricted product data: The vulnerable handler returns full WooCommerce product details (title, description, price, metadata) for the specified product ID regardless of its publication status (draft, pending, or private), exposing confidential product information (GitHub Commit, Wordfence).

• Network: Repeated unauthenticated HTTP POST requests to /wp-admin/admin-ajax.php with action=eael_product_quickview_popup and varying product_id values from a single or rotating IP address.
• Logs: WordPress access logs showing high-frequency POST requests to admin-ajax.php with the eael_product_quickview_popup action parameter, particularly from unauthenticated sessions (no valid WordPress auth cookies).
• Application: Successful JSON responses containing WooCommerce product data for products not publicly listed on the storefront, indicating unauthorized data retrieval.

Site administrators should update the Essential Addons for Elementor plugin to version 6.5.6 or later, which includes the security fix that adds product visibility and post status checks before returning product data. The patch was committed to the plugin repository as commit 4e43db0 and is available via the WordPress plugin update mechanism. As a temporary workaround for sites unable to update immediately, restricting access to wp-admin/admin-ajax.php for unauthenticated users via WAF rules or server configuration can reduce exposure, though this may affect other plugin functionality (GitHub Commit, Wordfence).

Wordfence, which discovered and reported the vulnerability, published a threat intelligence entry detailing the flaw and its impact on WooCommerce-enabled WordPress sites. The vulnerability received standard coverage from automated CVE tracking services and security aggregators including VulDB, CVEFeed, and CIRCL, but did not generate significant broader media or researcher commentary given its medium severity rating.