CVE-2026-7284
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The Easy Elements for Elementor plugin for WordPress up to version 1.4.4 allows unauthenticated attackers to register with the administrator role. The 'easyel_handle_register' function does not restrict user roles during registration.
Risk Assessment
An attacker can gain full control over the WordPress site, leading to data compromise and further attacks.
Recommendation
Update the Easy Elements plugin to the latest available version that fixes this vulnerability.
Original NVD description (English source)
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.