Ghostwire

CVE-2026-4106: The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some...

MEDIUM CVSS 0.0 Exploit Available 1 PoC

Published: April 23, 2026 | Last Modified: April 23, 2026

Description

The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days

Ghostwire Analysis — What This Means Practically

1 proof-of-concept exploit available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.
12 articles from independent security sources have covered this vulnerability, indicating significant industry attention.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Proof-of-Concept Exploits (1)

ef3tr/CVE-2026-4106

CVE-2026-4106: The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some...

Description

Ghostwire Analysis — What This Means Practically

Proof-of-Concept Exploits (1)

Security Coverage (12 articles)

References