---
id: "CVE-2026-118205"
kind: "vulnerability"
aliases: ["CVE-2026-118205"]
title: "Essential Addons for Elementor: unauthenticated users can register as Editor"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "essential-addons-for-elementor", "package", "wordpress"]
not_affected_if: ["plugin-not-installed", "registration-disabled", "version-above-6.8.7"]
published_at: "2026-10-30T18:17:24+00:00"
first_seen_at: "2026-10-30T18:55:29+00:00"
updated_at: "2026-10-30T18:56:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118205", "first_seen_at": "2026-10-30T18:55:29+00:00"}]
---

# Essential Addons for Elementor: unauthenticated users can register as Editor

The Essential Addons for Elementor WordPress plugin, up to and including 6.8.7, lets an unauthenticated visitor register a new account with a role as high as Editor. An attacker gets capabilities such as editing others' posts, publishing pages, uploading files and unfiltered HTML.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins; affected versions are `6.8.7` and earlier.
- Check whether Settings > General > Membership has "Anyone can register" enabled.
- Check whether an administrator has saved a non-default "New User Role" on a page using the Login/Register widget.

## Fix

- Essential Addons for Elementor: a fixed version is not stated in the sources; unknown

## Timeline

- 2026-10-30T18:55:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118205

## From the sources

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` — by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has "Anyone can register" enabled and that an administrator has at some point saved and then reverted a non-default "New User Role" on an affected page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_