{"id":"CVE-2026-110898","kind":"vulnerability","aliases":["CVE-2026-110898"],"related":[],"title":"WordPress Essential Addons for Elementor: privilege escalation through incorrect privilege assignment","description":"Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.","summary":"Essential Addons for Elementor, a WordPress plugin, has an incorrect privilege assignment flaw that allows privilege escalation. An attacker with a low-privilege account could gain higher rights on the site.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or run `wp plugin get essential-addons-for-elementor-lite --field=version` with WP-CLI\n- Look for the plugin slug `essential-addons-for-elementor-lite` in the site's plugin directory","fix":"- Update Essential Addons for Elementor (essential-addons-for-elementor-lite) to a version later than `6.8.5`\n- Review user accounts and roles for unexpected administrator or editor accounts","status":"open","published_at":"2026-10-19T10:16:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:59:33+00:00","updated_at":"2026-10-25T03:59:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:59:33Z","model":"claude-haiku-5-5","output":{"fix":"- Update Essential Addons for Elementor (essential-addons-for-elementor-lite) to a version later than `6.8.5`\n- Review user accounts and roles for unexpected administrator or editor accounts","reach":"internet","title":"WordPress Essential Addons for Elementor: privilege escalation through incorrect privilege assignment","impact":"medium","summary":"Essential Addons for Elementor, a WordPress plugin, has an incorrect privilege assignment flaw that allows privilege escalation. An attacker with a low-privilege account could gain higher rights on the site.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker gains elevated privileges on the WordPress site","analyst_note":"Check the NVD entry and WPDeveloper's changelog for the fixed version and the exact privilege and auth requirements.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or run `wp plugin get essential-addons-for-elementor-lite --field=version` with WP-CLI\n- Look for the plugin slug `essential-addons-for-elementor-lite` in the site's plugin directory","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running Essential Addons for Elementor at version `6.8.5` or earlier are affected. The sources do not say which roles or settings make a site more exposed. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3309,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110898':14A,17A '-2026':13A,16A '6.8.5':84C 'account':48B 'addon':3A,25B,63C,68C,78C 'affect':76C 'allow':38B,72C 'assign':11A,35B,58C 'attack':42B 'could':49B 'cve':12A,15A 'elementor':5A,18B,27B,65C,70C,80C 'escal':7A,40B 'escalation.this':74C 'essenti':2A,24B,62C,67C,77C 'essential-addons-for-elementor-lit':66C 'flaw':36B 'gain':50B 'higher':51B 'host':22B 'incorrect':9A,33B,56C 'issu':75C 'lite':71C 'low':46B 'low-privileg':45B 'n/a':82C 'packag':19B 'plugin':30B 'privileg':6A,10A,34B,39B,47B,57C,73C 'right':52B 'self':21B 'self-host':20B 'site':55B 'vulner':59C 'wordpress':1A,23B,29B 'wpdevelop':61C","nicknames":[],"mitigations":[],"who_affected":"Sites running Essential Addons for Elementor at version `6.8.5` or earlier are affected. The sources do not say which roles or settings make a site more exposed. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110898","severity":null,"published_at":"2026-10-19T10:16:45+00:00","modified_at":"2026-10-19T17:17:02+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}