CVE-2026-4362

A flaw in the ElementsKit Elementor Addons plugin for WordPress allows unauthenticated attackers to modify data without authorization. This vulnerability arises from the absence of capability checks on the Live_Action::reset() function, which is triggered when certain conditions are met during the WordPress initialization process. As a result, malicious visitors can create URLs that exploit this weakness and overwrite custom widget designs, text, and settings with default values.

Based on public CVE data (MITRE/NVD).