CVE-2026-13345

If you're running Essential Addons for Elementor, the product comparison widget has an access-control gap: it returns private and draft WooCommerce products to any visitor who requests them by ID. The underlying function — wc_get_product() or equivalent — fetches product data without checking post_status, so a request like ?product_id=123 returns the product regardless of whether it's published, private, or in draft. The widget then displays that data in the comparison table without any capability check to filter out non-public items. This matters because private products often contain sensitive data: unreleased SKUs, supplier pricing, internal product names, and inventory figures that constitute competitive intelligence. The widget doesn't just leak one product — it makes every private product in your catalog an enumerated target, because the attacker only needs to iterate through valid product IDs to pull any non-public product into the comparison view. The fix is straightforward: wrap the product lookup in a capability check before returning data to the frontend. In practice, that means adding something like current_user_can('manage_options') or a more granular check around the data-retrieval logic in the comparison widget's render method. The exact implementation depends on your codebase, but the principle is simple — treat WooCommerce product getters as data retrieval that requires explicit authorization, not as functions that inherit WordPress's page-level permissions. If you're auditing your own plugins for similar patterns: any call to wc_get_product(), get_post(), or similar data getters inside a public-facing context needs a visibility filter. The WooCommerce functions themselves are working as designed — they're data-retrieval tools, not authorization gates. The caller is responsible for checking post_status or capability before exposing that data. This is a known failure mode in the page-builder ecosystem specifically because those tools abstract away WordPress's permission layer while giving you direct access to WooCommerce's full data inventory.

Reviewed through automated stages and approved by a human before publication.