Live › vulnerability › CVE-2026-110537
Go to dashboardThe Essential Addons for Elementor WordPress plugin before 6.8.7 checks only a site-level capability before changing login-approval state for user accounts. On WordPress Multisite, a subsite administrator could therefore approve or block logins for accounts that belong to other sites on the network.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only WordPress Multisite networks running Essential Addons for Elementor before are exposed, and only to the cross-site part of the login-approval feature. Single-site installs are not affected by the cross-site issue, but they should still update to the fixed version.
6.8.7No product ranges from the sources yet.
wp plugin get essential-addons-for-elementor --field=versionwp core is-installed --network6.8.7 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
This page as .md · .json · in your agent: get_signal("CVE-2026-110537")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.