5.3
Medium
CVE-2026-91047 The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected…
Description
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ElementsReady Addons for Elementor 6.7 | earliest → 6.7.2 | No fix stated |