CVE-2026-110508
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow. When both features are enabled, unauthenticated users can register and log in without being approved by an administrator.
Risk Assessment
Unapproved accounts may gain access to site features intended for verified users, potentially leading to abuse, spam, or unauthorized access to content. The risk is especially relevant for sites that rely on manual account verification.
Recommendation
Update the Essential Addons for Elementor plugin to version 6.8.7 or later. Until updated, consider disabling either the email one-time-password flow or the approval requirement if they are not both needed.
Other vulnerabilities in Essential Addons for Elementor WordPress plugin
See all- CVE-2026-110537Low
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability. On WordPress Multisite this could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
- CVE-2026-110510Low
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup. This could allow users with the author role and above to inject iframe and form elements into published pages.
- CVE-2026-18039High
The Essential Addons for Elementor WordPress plugin before version 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.
Original NVD description (English source)
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS