What is CVE-2026-4326?

CVE-2026-4326 is a high-severity vulnerability in Webilia Vertex Addons For Elementor, classified under Missing Authorization. CVSS score: 8.8/10. Published 2026-04-09.

How severe is CVE-2026-4326?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Webilia Vertex Addons For Elementor

CVE-2026-4326

The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. This is due to improper authorization enforcement in the activate_required_plugins() function. Specifically, the current_user_can('install_plugins') capability check does not terminate execution when it fails — it only sets an error message variable while allowing the plugin installation and activation code to execute. The error response is only sent after the installation and activation have already completed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins from the WordPress.

Vulnerability class: Broken Access Control

EPSS: 0.006 (44.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Webilia Vertex Addons For Elementor — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2026-4326?: CVE-2026-4326 is a high-severity vulnerability in Webilia Vertex Addons For Elementor, classified under Missing Authorization. CVSS score: 8.8/10. Published 2026-04-09.
How severe is CVE-2026-4326?: High severity. CVSS v3 base score is 8.8 out of 10.