# Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.7 - Unauthenticated Uncontrolled Resource Consumption via Lost/Reset Password Form Options

- **ID:** WPSEC-2026-1938
- **Plugin:** Essential Addons for Elementor – Popular Elementor Templates & Widgets (`essential-addons-for-elementor-lite`), https://wordpress.org/plugins/essential-addons-for-elementor-lite/
- **Affected versions:** from 5.4.0 before 6.8.8
- **Fixed in:** 6.8.8 (Update to 6.8.8 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **Weakness:** CWE-400
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/essential-addons-for-elementor-lite
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1938/

## Description

The Essential Addons for Elementor plugin for WordPress is vulnerable to Uncontrolled Resource Consumption via the Login | Register widget's lost password and reset password handlers in all versions up to, and including, 6.8.7. This is due to the handlers, which run on every request on init, writing wp_options rows named after an arbitrary posted widget_id before any nonce or widget check. This makes it possible for unauthenticated attackers to create an unbounded number of rows in the options table.

## References

- https://wpsec.com/vuln/WPSEC-2026-1938/
- https://plugins.svn.wordpress.org/essential-addons-for-elementor-lite/tags/6.8.8/
- https://wordpress.org/plugins/essential-addons-for-elementor-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1938/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.