Live › vulnerability › CVE-2026-110508
Go to dashboardThe Essential Addons for Elementor WordPress plugin before 6.8.7 skips its administrator approval requirement for accounts created through its email one-time-password flow. An unauthenticated visitor can register and log in without an administrator approving the account, when both features are enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Sites running Essential Addons for Elementor before 6.8.7 with both the email one-time-password flow and the administrator approval requirement turned on. Sites that leave either feature off, or that do not run the plugin, are not exposed by this flaw.
No product ranges from the sources yet.
wp plugin get essential-addons-for-elementor --field=version6.8.7 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-110508")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.