CVE-2026-11600

Name of the Vulnerable Software and Affected Versions Envo's Templates & Widgets for Elementor and WooCommerce versions prior to 1.4.27

Description This issue involves unauthorized data access caused by a missing authorization check during template rendering in the Envo Tabs and Off Canvas widgets. The render() method of the Tabs widget passes a user-controlled template or post ID to the get builder content for display() function without verifying the post status (such as private or draft) or the visitor's permissions. Consequently, authenticated attackers with Author-level access or higher can disclose the contents of private Elementor-driven pages and templates to anonymous visitors. This is achieved by configuring an Envo Tabs widget on a public post to reference a private content ID, which can be modified via the Elementor editor REST API.

Recommendations Update to a version newer than 1.4.26. As a temporary mitigation, restrict Author-level users from editing Elementor widgets or accessing the Elementor editor REST API.