CVE-2026-2386: 
WordPress vulnerability analysis and mitigation

CVE-2026-2386 is an Incorrect Authorization vulnerability in the The Plus Addons for Elementor WordPress plugin (versions up to and including 6.4.7). The flaw allows authenticated attackers with Author-level access or above to create arbitrary draft posts for restricted post types such as page and nxt_builder. It was published on February 18, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, Feedly).

The root cause is Incorrect Authorization (CWE-863) in the plugin's tpae_create_page() AJAX handler. The handler checks only current_user_can('edit_posts') — a capability held by Authors — before passing a user-controlled post_type parameter directly to wp_insert_post() without performing post-type-specific capability checks (e.g., current_user_can('publish_pages')). This allows an Author-level user to supply a restricted post type such as page or nxt_builder in the AJAX request, bypassing the intended access controls and creating draft posts of those types (Red Hat CVE).

Exploitation results in a low-integrity impact: authenticated attackers can create unauthorized draft posts of restricted post types (e.g., WordPress Pages or custom builder templates) that they would not normally be permitted to create. There is no confidentiality or availability impact, and the scope is unchanged. While the immediate damage is limited, abuse could allow Authors to inject draft content into privileged post types, potentially staging content for later publication by higher-privileged users or disrupting editorial workflows (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability requires authenticated access at the Author level or above, limiting the attack surface. The EPSS score is approximately 0.026%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Authenticate: Log in to the target WordPress site with an account that has at least Author-level privileges (i.e., edit_posts capability).
2. Identify the AJAX endpoint: Locate the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) and confirm the Plus Addons for Elementor plugin (≤ 6.4.7) is active.
3. Craft the AJAX request: Send a POST request to admin-ajax.php with the action parameter targeting tpae_create_page and set the post_type parameter to a restricted type such as page or nxt_builder.
4. Bypass authorization: Because the handler only checks current_user_can('edit_posts') (satisfied by Authors), the post_type value is passed directly to wp_insert_post() without further capability validation.
5. Confirm post creation: Verify that a draft post of the restricted type has been created in the WordPress database, which would not normally be permitted for an Author-level user (Red Hat CVE).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php with action=tpae_create_page and a post_type value of page, nxt_builder, or other restricted types from Author-level accounts.
• Database: Unexpected draft posts of type page or nxt_builder authored by accounts with only Author-level roles in the wp_posts table.
• Logs: WordPress debug logs or server logs showing wp_insert_post() calls with restricted post types originating from low-privilege user sessions.

Update The Plus Addons for Elementor plugin to a version beyond 6.4.7 that includes a fix for this authorization bypass. Site administrators should review the WordPress plugin repository or the vendor's changelog for the patched release. As a temporary workaround, restrict Author-level accounts to trusted users only, or deactivate the plugin until a patch is applied. Regularly audit user roles and capabilities to limit the blast radius of similar authorization flaws (Red Hat CVE).