{
 "id": "WPSEC-2026-1938",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1938/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1938/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1938/index.md",
 "title": "Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.7 - Unauthenticated Uncontrolled Resource Consumption via Lost/Reset Password Form Options",
 "description": "The Essential Addons for Elementor plugin for WordPress is vulnerable to Uncontrolled Resource Consumption via the Login | Register widget's lost password and reset password handlers in all versions up to, and including, 6.8.7. This is due to the handlers, which run on every request on init, writing wp_options rows named after an arbitrary posted widget_id before any nonce or widget check. This makes it possible for unauthenticated attackers to create an unbounded number of rows in the options table.",
 "plugin": {
  "slug": "essential-addons-for-elementor-lite",
  "name": "Essential Addons for Elementor – Popular Elementor Templates & Widgets",
  "full_name": "Essential Addons for Elementor – Popular Elementor Templates & Widgets",
  "wordpress_org": "https://wordpress.org/plugins/essential-addons-for-elementor-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/essential-addons-for-elementor-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/essential-addons-for-elementor-lite"
 },
 "type": "DOS",
 "cwe": [
  "CWE-400"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.4.0",
    "from_inclusive": true,
    "to": "6.8.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.4.0 before 6.8.8"
  ]
 },
 "introduced_in": "5.4.0",
 "fixed_in": "6.8.8",
 "remediation": "Update to 6.8.8 or later.",
 "fix_released": "2026-10-28T11:26:42+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:46:20.783001+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1938/",
  "https://plugins.svn.wordpress.org/essential-addons-for-elementor-lite/tags/6.8.8/",
  "https://wordpress.org/plugins/essential-addons-for-elementor-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/essential-addons-for-elementor-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-29"
 }
}