CVE-2026-103907

The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit post block' and 'jeg find author' AJAX actions in versions up to, and including, 3.2.19. The 'wp ajax jkit post block' handler (registered generically for every element via wp ajax {$element id} in Elements Option Abstract::setup hook) returns the element's full option schema — including a freshly minted wp create nonce('jeg find author') — to any authenticated caller, and the 'wp ajax jeg find author' handler then runs a WP User Query with the attacker-supplied 'query' wrapped in '…' against search columns that include user email, echoing the ID and display name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle.