CVE-2026-42629: WordPress PowerPack Pro for Elementor plugin < v2.13.0 - Broken Authentication vulnerability

Synopsis

This is a broken authentication vulnerability in the PowerPack Pro for Elementor WordPress plugin, affecting all versions before v2.13.0. The vulnerability is reachable over the network without any credentials, though it requires a victim to perform some interaction, such as clicking a crafted link. Successful exploitation gives an attacker full read, write, and availability impact against the affected WordPress site. A patched-image rebuild at v2.13.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; there is no requirement for local or physical access.

• AuthenticationNot required

  No account or credentials of any kind are needed to attempt exploitation.

• Victim interactionRequired

  A user with access to the affected site must perform some action, such as clicking a crafted link or visiting an attacker-controlled page, for the attack to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker can read sensitive data from the WordPress site, including stored user credentials, session tokens, and private content.
• The attacker can write or modify persisted data, including posts, settings, and user account details.
• The attacker can disrupt availability of the affected WordPress site, causing service outages for legitimate users.
• Because all three impact dimensions are rated HIGH, a single successful exploit can result in full compromise of the affected WordPress installation.