The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ultimate Post Kit Plugin | — | Update ultimate-post-kit plugin to version 4.0.16, or a newer patched version | Jan 7, 2026 | Dec 10, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub