Live › vulnerability › CVE-2026-110808
The Essential Addons for Elementor WordPress plugin lets an Author-level user, or a visitor through the public registration form, have newly created accounts assigned a higher role such as Editor. An attacker gains elevated permissions on the WordPress site, which can lead to editing content and more.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running the Essential Addons for Elementor WordPress plugin from 6.6.0 through 6.8.7 that use its registration form. The sources do not describe a fix for CVE-2026-5193, so sites patched only against that advisory remain exposed until updated to 6.8.8.
No product ranges from the sources yet.
6.6.0 through 6.8.7.6.8.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly registered accounts, including those created by unauthenticated visitors through the public registration form, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented by a lower-privileged user, so versions 6.6.0 through 6.8.7 remain affected even on sites that are patched against that advisory.
This page as .md · .json · in your agent: get_signal("CVE-2026-110808")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.