# Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.6 - Unauthenticated Administrator Approval Bypass via Email OTP Registration

- **ID:** WPSEC-2026-1343
- **Plugin:** Essential Addons for Elementor – Popular Elementor Templates & Widgets (`essential-addons-for-elementor-lite`), https://wordpress.org/plugins/essential-addons-for-elementor-lite/
- **Affected versions:** from 6.7.3 before 6.8.7
- **Fixed in:** 6.8.7 (Update to 6.8.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/essential-addons-for-elementor-lite
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1343/

## Description

The Essential Addons for Elementor plugin for WordPress is vulnerable to an Administrator Approval bypass via the Login | Register widget's Email OTP registration flow in all versions from 6.7.3 up to, and including, 6.8.6. This is due to the OTP registration paths (the pre-created "Show Flag on User list" account and the account created on code verification) never setting the 'eael_registration_status' pending flag that the approval login check relies on, and the post-verification auto-login running regardless of the approval setting. This makes it possible for unauthenticated attackers to self-register an active account that can log in without the administrator approval the site requires. Exploitation requires user registration to be open, Administrator Approval to be enabled, and a Login | Register form with Email OTP registration enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1343/
- https://plugins.svn.wordpress.org/essential-addons-for-elementor-lite/tags/6.8.7/
- https://wordpress.org/plugins/essential-addons-for-elementor-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1343/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.