{"id":"CVE-2026-118205","kind":"vulnerability","aliases":["CVE-2026-118205"],"related":[],"title":"Essential Addons for Elementor: unauthenticated users can register as Editor","description":"The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed \"last saved by administrator\" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` — by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has \"Anyone can register\" enabled and that an administrator has at some point saved and then reverted a non-default \"New User Role\" on an affected page.","summary":"The Essential Addons for Elementor WordPress plugin, up to and including 6.8.7, lets an unauthenticated visitor register a new account with a role as high as Editor. An attacker gets capabilities such as editing others' posts, publishing pages, uploading files and unfiltered HTML.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","essential-addons-for-elementor","package","wordpress"],"not_affected_if":["plugin-not-installed","registration-disabled","version-above-6.8.7"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected versions are `6.8.7` and earlier.\n- Check whether Settings > General > Membership has \"Anyone can register\" enabled.\n- Check whether an administrator has saved a non-default \"New User Role\" on a page using the Login/Register widget.","fix":"- Essential Addons for Elementor: a fixed version is not stated in the sources; unknown","status":"open","published_at":"2026-10-30T18:17:24+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:56:52+00:00","updated_at":"2026-10-30T18:56:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T18:56:52Z","model":"claude-haiku-5-5","output":{"fix":"- Essential Addons for Elementor: a fixed version is not stated in the sources; unknown","reach":"internet","title":"Essential Addons for Elementor: unauthenticated users can register as Editor","impact":"high","summary":"The Essential Addons for Elementor WordPress plugin, up to and including 6.8.7, lets an unauthenticated visitor register a new account with a role as high as Editor. An attacker gets capabilities such as editing others' posts, publishing pages, uploading files and unfiltered HTML.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","essential-addons-for-elementor"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker registers as Editor and gains publishing and upload rights","analyst_note":"Confirm the fixed plugin version and whether the vendor has released a patch; the sources do not state one.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected versions are `6.8.7` and earlier.\n- Check whether Settings > General > Membership has \"Anyone can register\" enabled.\n- Check whether an administrator has saved a non-default \"New User Role\" on a page using the Login/Register widget.","plain_action":"","needs_analyst":true,"not_affected_if":["registration-disabled","plugin-not-installed","version-above-6.8.7"],"who_is_affected":"Sites running the Essential Addons for Elementor plugin at version 6.8.7 or earlier that allow anyone to register. Exploitation additionally needs an administrator to have saved and then reverted a non-default New User Role on a page bearing the Login/Register widget. Sites with registration closed, or without the plugin, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000776,"input_tokens":4508,"output_tokens":651,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118205':13A,16A '-2026':12A,15A '6.8.7':36B,92C 'account':44B,209C 'addon':2A,20B,27B,70C 'administr':149C,160C,242C,269C 'admit':121C 'affect':287C 'ajax':193C 'allow':130C 'anyon':262C 'attack':53B,132C,205C 'author':153C 'bear':251C 'capabl':55B,218C 'carri':125C 'check':150C 'contain':237C 'copi':170C 'cve':11A,14A 'data':236C 'default':281C 'deni':113C 'deny-list':112C 'draft':117C 'eael':195C 'edit':58B,159C,164C,220C 'editor':10A,51B,216C 'elementor':4A,17B,22B,29B,72C,74C,235C 'elev':239C 'enabl':265C 'endpoint':198C 'escal':84C 'essenti':1A,19B,26B,69C 'essential-addons-for-elementor':18B 'everi':127C 'exist':105C 'exploit':256C 'file':64B,226C 'flaw':145C 'freeli':185C 'function':102C 'futur':116C 'gain':217C 'gate':176C 'get':54B,196C 'handler':108C 'high':49B,214C 'html':67B,229C 'id':96C,137C,142C 'includ':35B,91C,219C 'ineffect':179C 'inherit':122C 'last':146C,165C 'later':246C 'let':37B 'list':114C 'live':140C 'login/register':253C 'make':200C 'meta':166C 'name':231C 'never':169C 'new':43B,282C 'non':280C 'non-default':279C 'nonc':175C,189C 'nopriv':194C 'obtain':186C 'other':59B,221C 'packag':23B 'page':62B,95C,141C,224C,250C,288C 'paramet':97C 'pend':119C 'plugin':31B,77C 'point':273C 'popular':73C 'possibl':202C 'post':60B,110C,152C,222C 'previous':243C 'privileg':83C 'publish':61B,223C 'rather':161C 'read':151C 'reflect':157C 'regist':8A,41B,100C,207C,264C 'reject':115C 'render':178C 'requir':257C 'revert':247C,277C 'revis':129C,136C,155C,172C,233C 'role':47B,212C,240C,284C 'save':147C,244C,274C 'site':260C 'status':111C,124C 'substitut':134C 'success':255C 'templat':75C 'token':197C 'unauthent':5A,39B,182C,204C 'unfilt':66B,228C 'upload':63B,225C 'user':6A,101C,283C 'valid':188C 'version':87C 'via':93C,190C 'visitor':40B,183C 'vulner':81C,104C 'whose':234C 'widget':76C,254C 'wordpress':24B,30B,79C,128C 'wp':192C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Essential Addons for Elementor plugin at version 6.8.7 or earlier that allow anyone to register. Exploitation additionally needs an administrator to have saved and then reverted a non-default New User Role on a page bearing the Login/Register widget. Sites with registration closed, or without the plugin, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118205","severity":null,"published_at":"2026-10-30T18:17:24+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}