Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Elementor Ally 4.1.0 security patch release (CVE-2026-2313)

Security Patch Release
First reported
Last updated
Happening score
H score 59
1 unique sources, 1 articles

Summary

Hide ▲

Elementor released Ally 4.1.0 to fix CVE-2026-2313, a SQL injection flaw in the WordPress accessibility plugin that could expose sensitive data. The update landed on February 23, 2026 and addresses affected Ally versions up to 4.0.3. Site owners running older releases need to move to 4.1.0 to close the vulnerability.

Related Happenings

RabbitMQ maintainers security patch release for CVE-2026-57219

Security Patch Release
H score29 First: 14.07.2026 16:48 Last: 14.07.2026 16:48 Sources 1

About this happening: RabbitMQ maintainers released fixed versions for multiple supported release lines, closing two access-control flaws that could expose OAuth client secrets and cross-te...

Open Happening

Gitea Docker images security update (CVE-2026-20896)

Security Patch Release
H score51 First: 06.07.2026 19:28 Last: 06.07.2026 19:28 Sources 1

About this happening: Gitea released version 1.26.3 to fix CVE-2026-20896, closing a critical authentication-bypass risk in Gitea Docker images. The update removed the default "*" wildc...

Open Happening

Dify security patch release for CVE-2026-41947

Security Patch Release
H score34 First: 22.06.2026 19:13 Last: 22.06.2026 19:13 Sources 1

About this happening: Dify shipped version 1.14.2 to fix most of the DifyTap vulnerabilities, closing cross-tenant paths that could expose AI chats, uploaded files, and internal API...

Open Happening

Squid web proxy patch for CVE-2026-47729

Security Patch Release
H score20 First: 22.06.2026 17:29 Last: 22.06.2026 17:29 Sources 1

About this happening: Squid maintainers merged a null-terminator check for CVE-2026-47729 into the development branch and v7, closing the FTP-parser over-read that could expose shar...

Open Happening

Gravity SMTP security patch release for CVE-2026-4020

Security Patch Release
H score16 First: 20.06.2026 12:56 Last: 20.06.2026 12:56 Sources 1

About this happening: Gravity SMTP released version 2.1.5 to fix CVE-2026-4020, closing a medium-severity information disclosure flaw in the WordPress plugin. The patch addresses a bug...

Open Happening

Timeline

  1. 11.03.2026 21:38 1 articles · 4mo ago

    Wordfence validates Ally SQL injection and discloses it to Elementor

    Initial Disclosure

    Drew Webber of Acquia identified an SQL injection vulnerability in Elementor's Ally WordPress plugin, and Wordfence validated the flaw and disclosed it to Elementor on February 13, 2026. The issue affected Ally versions up to 4.0.3 and could let an unauthenticated attacker inject SQL through the URL path to access sensitive data.

    Show sources
    Open in new tab
  2. 11.03.2026 21:38 2 articles · 4mo ago

    Elementor releases Ally 4.1.0 to fix CVE-2026-2313

    Mitigation Patch Update

    Elementor released Ally 4.1.0 on February 23, 2026 to fix CVE-2026-2313, closing the SQL injection path in the plugin's `get_global_remediations()` handling of a user-supplied URL parameter. The update addressed Ally versions up to 4.0.3 and came with an $800 bug bounty for the researcher.

    Show sources
    Open in new tab