CVE-2026-65502

Executive Summary

CVE-2026-65502 is an unauthenticated authentication bypass vulnerability in the Element Pack Elementor Addons plugin for WordPress, affecting all versions up to and including 8.7.13. This flaw allows a remote attacker to bypass security checks to modify non-sensitive settings without valid credentials, specifically impacting integrity (CVSS I:L) but not confidentiality or availability. Given the plugin's widespread use for building WordPress sites, any instance running a vulnerable version is at risk, and the lack of a vendor patch leaves affected sites exposed.

Technical Analysis

The vulnerability stems from a failure in proper authentication validation within the plugin's AJAX handler and settings REST endpoints. The flaw is categorized as CWE-290 (Authentication Bypass by Spoofing), indicating that the plugin trusts spoofable HTTP headers, cookies, or nonce values without verifying the user's actual session or capabilities.

In Element Pack Elementor Addons <= 8.7.13, the element_pack_ajax_ handlers and the register_rest_route for /element-pack/v1/settings lack a permission_callback or use an insecure nonce check. By manipulating the X-WP-Nonce header or the _wpnonce parameter with a value derived from publicly accessible data, an attacker can impersonate a logged-in administrator. The vulnerable code likely compares the nonce against the user ID without validating the user's role, allowing a forged request to pass the integrity check.

Attack surface:

• Public-facing AJAX endpoints: /wp-admin/admin-ajax.php with action prefixed element_pack_
• Public REST API routes: /wp-json/element-pack/v1/settings
• No authentication requirement (PR:N) and no user interaction (UI:N).

The low attack complexity (AC:L) and network vector (AV:N) mean any unauthenticated user can trigger the flaw. The impact is limited to integrity (I:L), meaning the attacker can alter plugin settings (e.g., change widget behavior, disable security features) but cannot read sensitive data or control the server directly. The successful exploitation results in unauthorized modification of the plugin's stored configuration.

Exploitation Scenarios

Step-by-step attack chain for an unauthenticated attacker:

1. Reconnaissance: The attacker identifies a WordPress site using the plugin via Shodan dorks such as http.component:"Elementor" or http.body:"element-pack-addons". They confirm the vulnerable version by fetching /wp-content/plugins/bdthemes-element-pack/readme.txt and checking "Stable tag:" for <= 8.7.13.

2. Nonce Harvesting: The attacker sends a GET request to a publicly accessible page that loads the Element Pack frontend scripts. From the rendered HTML or the JavaScript file (e.g., /wp-content/plugins/bdthemes-element-pack/assets/js/element-pack.min.js), they extract the wpApiSettings.nonce value, which is often exposed for logged-out users on certain configurations, or they forge one by leveraging predictable nonce generation in older WordPress versions.

3. Weaponization: The attacker crafts a POST request to /wp-admin/admin-ajax.php with parameters:

   action: element_pack_ajax_save_settings
   settings[disable_pro_widgets]: 1
   settings[allow_tracking]: 0
   _wpnonce: <harvested_nonce>
   

   Alternatively, they target the REST endpoint:

   POST /wp-json/element-pack/v1/settings HTTP/1.1
   Host: target.com
   Content-Type: application/json
   X-WP-Nonce: <harvested_nonce>
   {"disable_pro_widgets":true}
   

4. Execution: The vulnerable handler processes the request without verifying the current user's capability. Since the nonce matches (due to the spoofing flaw), the server accepts the forged settings update and persists the changes to the wp_options table.

5. Post-exploitation Impact: The attacker disables the plugin's security features (like sanitizing user inputs in widget settings) or injects malicious configuration values that are later rendered on the site, leading to stored XSS or defacement. The attacker can repeat this to lock out legitimate admins by changing the plugin's global settings, though they cannot escalate to full admin-level code execution due to the integrity-only scope.

Impact Assessment

• CVSS Score: 5.3 (Medium) — vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
• Business Impact: Unauthorized modification of plugin configuration can lead to website defacement, loss of trust, and indirect financial damage. The lack of confidentiality impact means no data theft, but integrity loss can corrupt business-critical site content or functionality.
• Affected Systems: Any WordPress installation with Element Pack Elementor Addons version <= 8.7.13. This includes enterprise marketing sites, ecommerce platforms, and corporate blogs using Elementor as their page builder.
• Blast Radius: While the vulnerability is a single-tenant issue (no privilege escalation), the ability to disable security configuration could pave the way for further attacks, such as injecting malicious scripts that affect all site visitors.
• Real-world context: No known exploitation in the wild or threat actor campaigns have been recorded. The vulnerability remains unpatched, increasing exposure windows for organizations that cannot immediately apply mitigations.

Detection Guidance

Sigma Rule

title: Element Pack Addons Unauthenticated Settings Modification
id: 4f8a0f7e-3c25-4b12-9e04-5b1d92d4a6f2
status: experimental
description: Detects attempts to exploit CVE-2026-65502 by sending forged nonce requests to Element Pack AJAX/REST endpoints.
logsource:
  category: webserver
  product: apache
detection:
  selection_ajax:
    cs-method: 'POST'
    cs-uri-query|contains:
      - 'admin-ajax.php'
      - 'action=element_pack_'
  selection_rest:
    cs-method: 'POST'
    cs-uri-query|contains:
      - '/wp-json/element-pack/v1/settings'
  condition: selection_ajax or selection_rest
level: medium
falsepositives:
  - Legitimate admin updates from trusted IPs
fields:
  - clientip
  - cs-uri-query

YARA Rule

rule ElementPack_NonceSpoof_CVE_2026_65502
{
    meta:
        author = "Valtersit SOC"
        description = "Detects HTTP requests attempting to exploit CVE-2026-65502 nonce bypass"
        date = "2026-02-15"
        cve = "CVE-2026-65502"
        severity = "medium"
    strings:
        $a = "element_pack_ajax_" nocase
        $b = "element-pack/v1/settings" nocase
        $c = "X-WP-Nonce" nocase
        $d = "_wpnonce" nocase
    condition:
        any of ($a,$b) and any of ($c,$d)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-65502 Element Pack Settings Bypass"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=element_pack_"; http_uri; content:"_wpnonce"; http_client_body; within:100; content:"settings"; http_client_body; within:500; classtype:attempted-admin; sid:2026065502; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.action == "http_request" and 
   url.path == "/wp-admin/admin-ajax.php" and 
   request.method == "POST" and 
   url.query contains "action=element_pack_"]
  [http where event.action == "http_request" and 
   url.path == "/wp-json/element-pack/v1/settings" and 
   request.method == "POST"]

Splunk SPL Query

index=web sourcetype=access_combined
  (uri="/wp-admin/admin-ajax.php" AND form_data="*action=element_pack_*") 
  OR (uri="/wp-json/element-pack/v1/settings")
  | table _time, clientip, uri, method
  | where method="POST"
  | stats count by clientip, uri
  | where count > 5

Wazuh OSSEC Rule

<rule id="733181" level="10">
  <decoded>json</decoded>
  <match>admin-ajax.php|element-pack/v1/settings</match>
  <regex>action=element_pack_|settings</regex>
  <description>Element Pack CVE-2026-65502 exploitation attempt</description>
  <group>authentication_failure,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No patch evidence exists from any tracked source as of the report date. The CVE description indicates versions <= 8.7.13 are affected, implying a future fix in a higher version, but no official vendor advisory has been released.

1. Immediate Mitigations:

   • Restrict access to AJAX endpoints: Use a Web Application Firewall (WAF) to block POST requests to admin-ajax.php from unauthenticated users, or specifically those containing action=element_pack_.
   • Disable REST API routes: Add a code snippet to functions.php to block /wp-json/element-pack/v1/* endpoints for non-admin users:

     add_filter('rest_endpoints', function($endpoints) {
         foreach ($endpoints as $route => $data) {
             if (strpos($route, 'element-pack/v1') !== false) {
                 unset($endpoints[$route]);
             }
         }
         return $endpoints;
     });
     

   • Network-level blocking: Use Shodan dorks to find exposed instances and alert owners via abuse contact if they are your assets.

2. Patch/Upgrade Steps:

   • Monitor the vendor (BdThemes) for updates. When a patched version is released (likely 8.7.14 or higher), update the plugin via the WordPress admin dashboard or through CLI: wp plugin update bdthemes-element-pack.
   • If no patch is available, consider temporarily deactivating the plugin until a fix is published.

3. Long-term Hardening:

   • Implement a strict Web Application Firewall policy to inspect WordPress nonce parameters for anomaly patterns.
   • Regularly monitor wp_options table for unauthorized changes to element_pack_ prefixed option names.
   • Enable audit logging for all plugin configuration changes and alert on any modifications originating from unauthenticated IPs.
   • Subscribe to vendor threat advisories and CVE feeds to receive immediate patch notifications.

References

• NVD Entry CVE-2026-65502 **
• WordPress Plugin Repository: Element Pack
• CWE-290: Authentication Bypass by Spoofing
• BdThemes Official Website — monitor for security advisories
• No CISA KEV listing exists (status: NO). No threat actor campaigns or exploit-in-the-wild evidence documented at the time of writing.