CVE-2026-23693
Description
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.
How to fix
- Roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor3.7.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | v < 3.7.9 | 3.7.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.