# Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.8.7 - Unauthenticated Privilege Escalation via Login | Register Widget Registration Role

- **ID:** WPSEC-2026-1939
- **Plugin:** Essential Addons for Elementor – Popular Elementor Templates & Widgets (`essential-addons-for-elementor-lite`), https://wordpress.org/plugins/essential-addons-for-elementor-lite/
- **Affected versions:** all versions before 6.8.8
- **Fixed in:** 6.8.8 (Update to 6.8.8 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/essential-addons-for-elementor-lite
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1939/

## Description

The Essential Addons for Elementor plugin for WordPress is vulnerable to Privilege Escalation via the Login | Register widget's user registration handler in all versions up to, and including, 6.8.7. This is due to the handler accepting a client-supplied page_id that may point to a post revision, reading the new-user role from that revision's stored widget settings, and approving it based on the revision's author rather than the users responsible for the current page. This makes it possible for unauthenticated attackers, on sites that allow user registration, to register an account with an elevated role such as Editor when a revision saved by an administrator holds that role, for example a role the administrator has since removed, or one an author-level user wrote into the widget data before an administrator re-saved the page in Elementor.

## References

- https://wpsec.com/vuln/WPSEC-2026-1939/
- https://plugins.svn.wordpress.org/essential-addons-for-elementor-lite/tags/6.8.8/
- https://wordpress.org/plugins/essential-addons-for-elementor-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1939/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.