CVE-2026-13345

Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.

We have discovered 261,484 live websites that are affected by CVE-2026-13345.

Run a Free Instant Scan



Affected Software

Product  Essential Addons for Elementor
Category Wordpress Plugins
Vulnerable Domains261,484 live websites (99% of Essential Addons for Elementor install base)
Vulnerable Versions
  • from 0 through 6.6.10
Vulnerable Versions Count165 versions ( 97% of all versions)


Common Weakness Enumeration

CWE-639 Authorization Bypass Through User-Controlled Key



Details

  • Published - Jul 30, 2026
  • Updated - Jul 30, 2026

Credits

  • Revanth Hari Narayana Matte (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-13345
United States79,351 websites


Germany24,381 websites
France15,207 websites
Brazil11,756 websites
GB11,296 websites
Spain8,721 websites
Italy8,202 websites
India8,059 websites
Netherlands6,744 websites
Poland5,713 websites

Website Distribution by TLD

Number of websites using CVE-2026-13345
.com109,393 websites
.org15,907 websites
.de13,934 websites
.com.br10,616 websites
.fr7,014 websites
.co.uk6,191 websites
.nl5,903 websites
.it5,890 websites
.net4,835 websites
.com.au4,499 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-13345

Top websites that are affected by CVE-2026-13345. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.net United States*,***
******.com United States*,***
******.com France*,***
******.com United States*,***
********.org United States*,***
********.com United States*,***
****************.nl United States*,***
*********.com United States*,***
******************.de Germany**,***
*******.co Serbia**,***
See full domain list

FAQ

CVE-2026-13345 is Authorization Bypass Through User-Controlled Key in Essential Addons for Elementor
A total of 261,484 websites have been identified as vulnerable to CVE-2026-13345, based on global website indexing conducted by WebTechSurvey.
The Essential Addons for Elementor is affected by the CVE-2026-13345 vulnerability.
Essential Addons for Elementor versions up to 6.6.10 are vulnerable to CVE-2026-13345.
CVE-2026-13345 is resolved in version 6.6.10 of Essential Addons for Elementor.