Now officially on WordPress.org

CVE Database / CVE-2026-49782

CVE · Medium

CVE-2026-49782 — Elementor Website Builder – more than just a page builder [elementor] < 4.1.1

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-49782 Elementor Website Builder – more than just a page builder [elementor] < 4.1.1 Missing Authorization Medium 5.4 < 4.1.1 4.1.1 2026-06-02 —

CVE-2026-49782

Authenticated users with contributor-level access or higher can exploit a vulnerability in Elementor Website Builder plugin for WordPress by bypassing capability checks on certain functions, allowing them to execute unauthorized actions. The issue affects versions up to and including 4.1.0. This flaw enables malicious users to perform actions they shouldn't be able to do within the website's administration area.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings