CVE-2026-117524

Name of the Vulnerable Software and Affected Versions Dynific Addons for Elementor versions prior to 1.3.1

Description Authenticated users with at least the Contributor role can disclose the content of draft, private, and password-protected posts. This occurs because the plugin fails to perform a status or capability check when resolving post identifiers passed to one of its shortcodes. Additionally, a user with the Author role can republish this disclosed content to anonymous visitors.

Recommendations Update to version 1.3.1 or later.