Risk Letters

Exploited vulnerability

CVE-2026-4106

TLP:CLEAR

Exposure of Sensitive Information to an Unauthorized Actor

The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days

Facts

  • Vendor: HasThemes
  • Product: HT Mega Addons for Elementor
  • EPSS (probability of exploitation within 30 days): 0.7 %
  • First known exploitation: 13 October 2026
  • First seen by Risk Letters: 13 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD