CVE-2026-11905

MEDIUM CVSS 4.3
Published: 2026-10-15
Modified: 2026-10-15
Tenable Plugin

Checking the public Tenable catalog…

Threat Intelligence Pending

IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.

Description

The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full post_content and plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors.

Quick Facts
CVE ID CVE-2026-11905
CVSS Score 4.3
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published 2026-10-15
Exploited No
CISA KEV No
PoC Not public
References
External Resources
NVD Entry BleepingComputer The Hacker News