CVE-2026-18039
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Essential Addons for Elementor WordPress plugin before version 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.
Risk Assessment
An unauthenticated attacker can obtain an administrator account, leading to full compromise of the WordPress site. This can result in data theft, defacement, or use of the server for further attacks.
Recommendation
Update the Essential Addons for Elementor plugin to version 6.7.2 or later. Check for existing accounts with unexpected roles and remove them.
Original NVD description (English source)
The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.