Is CVE-2026-91047 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-91047

Description

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.