https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 21:16:04 +0000 https://db.gcve.eu/vuln/cve-2026-103907 <p><strong>Affected:</strong> jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets &amp; Templates for WordPress</p> <p>The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the &#39;jkit_post_block&#39; and &#39;jeg_find_author&#39; AJAX actions in versions up to, and including, 3.2.19. The &#39;wp_ajax_jkit_post_block&#39; handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element&#39;s full option schema — including a freshly minted wp_create_nonce(&#39;jeg_find_author&#39;) — to any authenticated caller, and the &#39;wp_ajax_jeg_find_author&#39; handler then runs a WP_User_Query with the attacker-supplied &#39;query&#39; wrapped in &#39;*…*&#39; against search_columns that include user_email, echoing the ID and display_name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users&#39; email addresses one character at a time by using the substring search as an oracle.</p> <p><strong>Affected:</strong> jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets &amp; Templates for WordPress</p> <p>The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the &#39;jkit_post_block&#39; and &#39;jeg_find_author&#39; AJAX actions in versions up to, and including, 3.2.19. The &#39;wp_ajax_jkit_post_block&#39; handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element&#39;s full option schema — including a freshly minted wp_create_nonce(&#39;jeg_find_author&#39;) — to any authenticated caller, and the &#39;wp_ajax_jeg_find_author&#39; handler then runs a WP_User_Query with the attacker-supplied &#39;query&#39; wrapped in &#39;*…*&#39; against search_columns that include user_email, echoing the ID and display_name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users&#39; email addresses one character at a time by using the substring search as an oracle.</p> https://db.gcve.eu/vuln/cve-2026-103907