CVE-2026-118205
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The Essential Addons for Elementor plugin for WordPress up to 6.8.7 is vulnerable to privilege escalation via the page_id parameter of the register_user() function. An unauthenticated attacker can register an account with a role as high as Editor by abusing revision status and nonce bypass. Exploitation requires user registration enabled and an administrator having previously saved and reverted a non-default role on an affected page.
Risk Assessment
An attacker could gain Editor-level capabilities, including editing others' posts, publishing pages, uploading files, and inserting unfiltered HTML. This could lead to site compromise.
Recommendation
Update the plugin to a patched version. Until then, consider disabling public registration and restricting access to the wp_ajax_nopriv_eael_get_token endpoint.
Other vulnerabilities in Essential Addons for Elementor
See all- CVE-2026-110898Medium
The Essential Addons for Elementor plugin up to version 6.8.5 contains an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation. The issue stems from flawed privilege checks within the plugin component.
- CVE-2026-102394Medium
The Essential Addons for Elementor plugin for WordPress contains a Stored XSS vulnerability in versions up to and including 6.8.4. An attacker can inject malicious script that will execute in the browser of an administrator or other user.
- CVE-2026-6459Medium
The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar widget in all versions up to and including 6.6.2 due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar.
- CVE-2026-7665Medium
The Essential Addons for Elementor plugin for WordPress up to version 6.6.4 has an information exposure vulnerability via the ajax_load_more function. Unauthenticated attackers can extract data from password-protected, private, or draft posts.
- CVE-2026-110808Medium
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form. Authenticated users with Author-level access and above can cause newly registered accounts, including those created by unauthenticated visitors, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented, so versions 6.6.0 through 6.8.7 remain affected.
- CVE-2026-110509Medium
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint. This could allow reading content of non-public post types and recovering values of private custom fields on published posts.
- CVE-2026-81777Medium
Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor from n/a through 6.8.0.
- CVE-2026-13345Medium
The Essential Addons for Elementor WordPress plugin before version 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature. This allows unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.
- CVE-2026-13344Medium
The Essential Addons for Elementor WordPress plugin before version 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it. This allows users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post.
- CVE-2026-15145Medium
The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` — by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has "Anyone can register" enabled and that an administrator has at some point saved and then reverted a non-default "New User Role" on an affected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS