Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.7 - Unauthenticated Privilege Escalation via Login | Register Widget Registration Role
- ID
- WPSEC-2026-1939
- Plugin
- Essential Addons for Elementor – Popular Elementor Templates & Widgets (essential-addons-for-elementor-lite)
- Affected
- all versions before 6.8.8
- Remediation
- Update to 6.8.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-29
- Attack surface
- Essential Addons for Elementor – Popular Elementor Templates & Widgets on WPSec AttackSurface
- Fix released
- Published
Description
The Essential Addons for Elementor plugin for WordPress is vulnerable to Privilege Escalation via the Login | Register widget's user registration handler in all versions up to, and including, 6.8.7. This is due to the handler accepting a client-supplied page_id that may point to a post revision, reading the new-user role from that revision's stored widget settings, and approving it based on the revision's author rather than the users responsible for the current page. This makes it possible for unauthenticated attackers, on sites that allow user registration, to register an account with an elevated role such as Editor when a revision saved by an administrator holds that role, for example a role the administrator has since removed, or one an author-level user wrote into the widget data before an administrator re-saved the page in Elementor.
References
- https://wpsec.com/vuln/WPSEC-2026-1939/
- https://plugins.svn.wordpress.org/essential-addons-for-elementor-lite/tags/6.8.8/
- https://wordpress.org/plugins/essential-addons-for-elementor-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS