CVE-2026-4106

HT Mega < 3.0.7 – Unauthenticated PII Disclosure

Medium · published April 23, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
53.7
In the wild
Unconfirmed
What it is

The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00730 · 53.7th percentile
Published
2026-04-23T06:00Z
EPSS history
Timeline
  • 23 APR 06:00Z
    HT Mega < 3.0.7 – Unauthenticated PII Disclosure
    cvelistv5