CVE-2026-91047 — ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated user…
Published: 2026-10-19 · CVSS: 5.3 · CVSS 3.1
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7