Vulnerabilities / Essential Addons for Elementor – Popular Elementor Templates & Widgets / WPSEC-2026-1938
Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.7 - Unauthenticated Uncontrolled Resource Consumption via Lost/Reset Password Form Options
Medium 5.3
CWE-400Fixed in 6.8.8
- ID
- WPSEC-2026-1938
- Plugin
- Essential Addons for Elementor – Popular Elementor Templates & Widgets (essential-addons-for-elementor-lite)
- Affected
- from 5.4.0 before 6.8.8
- Remediation
- Update to 6.8.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-400
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-29
- Attack surface
- Essential Addons for Elementor – Popular Elementor Templates & Widgets on WPSec AttackSurface
- Fix released
- Published
Description
The Essential Addons for Elementor plugin for WordPress is vulnerable to Uncontrolled Resource Consumption via the Login | Register widget's lost password and reset password handlers in all versions up to, and including, 6.8.7. This is due to the handlers, which run on every request on init, writing wp_options rows named after an arbitrary posted widget_id before any nonce or widget check. This makes it possible for unauthenticated attackers to create an unbounded number of rows in the options table.
References
- https://wpsec.com/vuln/WPSEC-2026-1938/
- https://plugins.svn.wordpress.org/essential-addons-for-elementor-lite/tags/6.8.8/
- https://wordpress.org/plugins/essential-addons-for-elementor-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS