{"id":"CVE-2026-110808","kind":"vulnerability","aliases":["CVE-2026-110808"],"related":[],"title":"WordPress Essential Addons for Elementor: registration can grant Editor role","description":"The Essential Addons for Elementor  WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly registered accounts, including those created by unauthenticated visitors through the public registration form, to be granted a higher role such as Editor.\nThis is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented by a lower-privileged user, so versions 6.6.0 through 6.8.7 remain affected even on sites that are patched against that advisory.","summary":"The Essential Addons for Elementor WordPress plugin lets an Author-level user, or a visitor through the public registration form, have newly created accounts assigned a higher role such as Editor. An attacker gains elevated permissions on the WordPress site, which can lead to editing content and more.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["essential-addons-for-elementor","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","registration-form-disabled","version-6.8.8-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected versions are `6.6.0` through `6.8.7`.\n- Confirm whether the public registration form is enabled for the site and whether it sets account roles.","fix":"- Essential Addons for Elementor (WordPress): update to `6.8.8` or later.","status":"open","published_at":"2026-10-31T06:16:32+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:32+00:00","updated_at":"2026-10-31T06:34:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T06:34:32Z","model":"claude-haiku-5-5","output":{"fix":"- Essential Addons for Elementor (WordPress): update to `6.8.8` or later.","reach":"internet","title":"WordPress Essential Addons for Elementor: registration can grant Editor role","impact":"medium","summary":"The Essential Addons for Elementor WordPress plugin lets an Author-level user, or a visitor through the public registration form, have newly created accounts assigned a higher role such as Editor. An attacker gains elevated permissions on the WordPress site, which can lead to editing content and more.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","essential-addons-for-elementor","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated visitors gain Editor-level accounts on the WordPress site","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected versions are `6.6.0` through `6.8.7`.\n- Confirm whether the public registration form is enabled for the site and whether it sets account roles.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-6.8.8-or-later","registration-form-disabled"],"who_is_affected":"Sites running the Essential Addons for Elementor WordPress plugin from 6.6.0 through 6.8.7 that use its registration form. The sources do not describe a fix for CVE-2026-5193, so sites patched only against that advisory remain exposed until updated to 6.8.8.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4225,"output_tokens":575,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110808':13A,16A '-2026':12A,15A,142C '-5193':143C '6.6.0':151C,163C '6.8.7':165C '6.8.8':82C 'access':107C 'account':51B,94C,114C 'add':149C 'addon':3A,19B,29B,76C 'advisori':176C 'affect':167C 'allow':100C 'assign':52B,92C 'attack':60B 'authent':101C 'author':37B,105C 'author-level':36B,104C 'caus':111C 'circumv':154C 'content':73B 'control':148C 'correct':85C 'creat':50B,95C,117C 'cve':11A,14A,141C 'edit':72B 'editor':9A,58B,134C 'elementor':5A,21B,31B,78C 'elev':62B 'essenti':2A,18B,28B,75C 'essential-addons-for-elementor':17B 'even':168C 'fix':139C 'form':47B,99C,125C 'gain':61B 'grant':8A,128C 'higher':54B,130C 'host':25B 'includ':115C 'incomplet':138C 'lead':70B 'let':34B 'level':38B,106C 'lower':158C 'lower-privileg':157C 'may':88C 'newli':49B,112C 'packag':22B 'patch':173C 'permiss':63B 'plugin':33B,80C 'privileg':159C 'public':45B,123C 'regist':113C 'registr':6A,46B,98C,124C 'remain':166C 'restrict':86C 'role':10A,55B,91C,131C,146C 'role-valid':145C 'self':24B 'self-host':23B 'set':89C 'site':67B,170C 'unauthent':119C 'user':39B,102C,160C 'valid':147C 'version':162C 'visitor':42B,120C 'wordpress':1A,26B,32B,66B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Essential Addons for Elementor WordPress plugin from 6.6.0 through 6.8.7 that use its registration form. The sources do not describe a fix for CVE-2026-5193, so sites patched only against that advisory remain exposed until updated to 6.8.8.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110808","severity":null,"published_at":"2026-10-31T06:16:32+00:00","modified_at":"2026-10-31T06:16:32+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}