CVE-2026-4106

—

CVSS 3.1

5.3 medium

EPSS

<1%p53

Published

Apr 23, 2026 (Apr 23, 2026)

Modified

Jun 17, 2026

Description

The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days

Ecosystems: WordPress
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.