Live › vulnerability › CVE-2026-118205
The Essential Addons for Elementor WordPress plugin, up to and including 6.8.7, lets an unauthenticated visitor register a new account with a role as high as Editor. An attacker gets capabilities such as editing others' posts, publishing pages, uploading files and unfiltered HTML.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the Essential Addons for Elementor plugin at version 6.8.7 or earlier that allow anyone to register. Exploitation additionally needs an administrator to have saved and then reverted a non-default New User Role on a page bearing the Login/Register widget. Sites with registration closed, or without the plugin, are not affected.
No product ranges from the sources yet.
6.8.7 and earlier.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the page_id parameter of the register_user() function. The vulnerability exists because the handler's post status deny-list rejects future, draft, and pending but admits inherit — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads post_author on revisions (which reflects the editing administrator) rather than the _edit_last meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the wp_ajax_nopriv_eael_get_token endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including edit_others_posts, publish_pages, upload_files, and unfiltered_html — by naming a revision whose _elementor_data contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has "Anyone can register" enabled and that an administrator has at some point saved and then reverted a non-default "New User Role" on an affected page.
This page as .md · .json · in your agent: get_signal("CVE-2026-118205")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.