The /elementor/v1/user REST endpoint only requires the edit_posts capability, yet it ran its own get_users() query instead of going through WordPress core’s user listing. Any authenticated user with Contributor privileges or above could therefore enumerate every account on the site, pass arbitrary meta_query conditions to probe hidden user meta, and — by supplying a custom keys_conversion_map — have raw WP_User properties returned, including the data object with user_email and the user_pass hash. The fix proxies the endpoint to core’s /wp/v2/users route so the standard list_users capability check applies, and returns only the ID, display name and role.
This vulnerability affects the following application versions:
- Elementor Website Builder 3.33.0
- Elementor Website Builder 3.33.0-beta1
- Elementor Website Builder 3.33.0-beta2
- Elementor Website Builder 3.33.0-beta3
- Elementor Website Builder 3.33.0-beta4
- Elementor Website Builder 3.33.0-dev1
- Elementor Website Builder 3.33.0-dev2
- Elementor Website Builder 3.33.0-dev3
- Elementor Website Builder 3.33.0-dev4
- Elementor Website Builder 3.33.1
- Elementor Website Builder 3.33.2
- Elementor Website Builder 3.33.3
- Elementor Website Builder 3.33.4
- Elementor Website Builder 3.33.5
- Elementor Website Builder 3.33.6
- Elementor Website Builder 3.34.0
- Elementor Website Builder 3.34.0-beta1
- Elementor Website Builder 3.34.0-beta2
- Elementor Website Builder 3.34.0-beta3
- Elementor Website Builder 3.34.0-dev1
- Elementor Website Builder 3.34.0-dev2
- Elementor Website Builder 3.34.1
- Elementor Website Builder 3.34.2
- Elementor Website Builder 3.34.3
- Elementor Website Builder 3.34.4
- Elementor Website Builder 3.35.0
- Elementor Website Builder 3.35.0-beta1
- Elementor Website Builder 3.35.0-beta2
- Elementor Website Builder 3.35.0-beta3
- Elementor Website Builder 3.35.0-beta4
- Elementor Website Builder 3.35.0-dev1
- Elementor Website Builder 3.35.0-dev2
- Elementor Website Builder 3.35.0-dev3
- Elementor Website Builder 3.35.0-dev4
- Elementor Website Builder 3.35.1
- Elementor Website Builder 3.35.2
- Elementor Website Builder 3.35.3
- Elementor Website Builder 3.35.4
- Elementor Website Builder 3.35.5
- Elementor Website Builder 3.35.6
- Elementor Website Builder 3.35.7
- Elementor Website Builder 3.35.8
- Elementor Website Builder 3.35.9
- Elementor Website Builder 4.0.0
- Elementor Website Builder 4.0.0-beta1
- Elementor Website Builder 4.0.0-beta2
- Elementor Website Builder 4.0.0-beta3
- Elementor Website Builder 4.0.0-beta4
- Elementor Website Builder 4.0.0-beta5
- Elementor Website Builder 4.0.0-dev1
- Elementor Website Builder 4.0.0-dev2
- Elementor Website Builder 4.0.0-dev3
- Elementor Website Builder 4.0.0-dev4
- Elementor Website Builder 4.0.0-dev5
- Elementor Website Builder 4.0.1
- Elementor Website Builder 4.0.2
- Elementor Website Builder 4.0.3
- Elementor Website Builder 4.0.4
- Elementor Website Builder 4.0.5