---
id: "CVE-2026-110508"
kind: "vulnerability"
aliases: ["CVE-2026-110508"]
title: "Essential Addons for Elementor: email OTP signup skips admin approval"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["default-config", "plugin-updated"]
published_at: "2026-10-28T11:17:14+00:00"
first_seen_at: "2026-10-28T11:32:27+00:00"
updated_at: "2026-10-28T11:33:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110508", "first_seen_at": "2026-10-28T11:32:27+00:00"}]
---

# Essential Addons for Elementor: email OTP signup skips admin approval

The Essential Addons for Elementor WordPress plugin before 6.8.7 skips its administrator approval requirement for accounts created through its email one-time-password flow. An unauthenticated visitor can register and log in without an administrator approving the account, when both features are enabled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in WordPress admin under Plugins, or with `wp plugin get essential-addons-for-elementor --field=version`
- Look at the plugin settings to see whether the email one-time-password login and the administrator approval option are both enabled
- Review the users list for recently registered accounts marked pending or unapproved that can still log in

## Fix

- Update Essential Addons for Elementor to `6.8.7` or later
- If an update cannot be applied yet, disable the email one-time-password registration feature or the administrator approval setting until it is

## Timeline

- 2026-10-28T11:32:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110508

## From the sources

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_